Comments on Proposed Standards to Protect Health Care Information

B. Specific applications of the term "individual"

It is our understanding that the definition of "individual," including its treatment of minors, applies throughout the rule wherever the term "individual" is used. We are concerned, however, that one isolated reference in the preamble (page 59973) to the applicability of the definition of "individual" in one specific context may raise the inference that this definition may not apply in other contexts. As a result, we recommend that this one statement in the preamble be deleted and that the preamble include the explanatory language below.

Proposed language:

1. Delete from the preamble discussion of the next-of-kin section (page 59973) the following statement: "The proposed definition of 'individual' addresses related disclosures regarding minors and incapacitated individuals."

2. Amend the preamble at page 59935 as follows:

c. Disclosures pertaining to minors. In general, because the definition of individual would include parents, a parent, guardian, or person acting in loco parentis could exercise the rights established under this regulation on behalf of their minor (as established by applicable law) children. However, in cases where a minor lawfully obtains a health care service without the consent of or notification to a parent, the minor would be treated as the individual for purposes of exercising any rights established under this regulation with respect to protected health information relating to such health services. For example, a minor who lawfully obtains a health care service without parental consent would have the rights of the "individual," guaranteed under sections 164.510(h) and 164.510(l), to agree or object to the release of directory information or disclosures to next-of-kin pertaining to care received without parental consent. . . .

C. Minors who become emancipated or attain majority

We suggest the Department clarify the proposed rule's application to situations in which an adult or emancipated minor is seeking access to (or is being asked to authorize disclosure of) protected health information concerning health care services rendered while the person was an unemancipated minor. The appropriate policy is as follows: once a minor becomes emancipated or attains majority, as determined by applicable State law, the minor should exercise the rights of an individual with respect to protected health information relating to services rendered while the person was an unemancipated minor.

Proposed language: We do not believe it is necessary to change the language of the rule itself because under the existing definition of "individual," nothing appears to limit the ability of adults to obtain access to protected health information relating to services rendered while the individual was a minor. It would be helpful, however, for the Department to state this interpretation of the rule in the preamble.

5. Treatment (Disease Management)

The definition of treatment appropriately includes disease management programs which involve "the coordination of health care . . . among health care providers." We are concerned, however, that some employers may rely upon the inclusion of this concept within the definition of treatment to demand what should be protected health information from their health plan component or occupational health component to "force" individual employees with targeted conditions into self-care or medication compliance programs in ways that violate both the employee's privacy interest and his or her right to autonomously control his or her own medical care. To guard against such abuses of the unauthorized disclosures permitted for purposes of treatment under the regulation the Secretary should clarify and appropriately restrict the meaning of the disease management terminology used in the definition of treatment.

TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS

Section 164.506 Uses and disclosures of protected health information: general rules.

1. Initial Authorizations For Treatment, Payment And Health Care Operations Purposes

Recommendation:

The regulations should require authorization from the individual for the use and disclosure of information for treatment, payment and health care operations, which should be renewed at least once every three years or whenever the patient changes insurance companies, whichever occurs first.

Rationale:

We disagree with the Secretary's basic premise that requiring patient authorization for treatment, payment and health care operations is a meaningless enterprise. This issue was addressed at length by the Health Privacy Working Group, a panel comprised of diverse stakeholders including: disability and mental health advocates; health plans; providers; employers; standards and accreditation representatives; and experts in public health, medical ethics, information systems and health policy: Best Principles for Health Privacy, a Report of the Health Privacy Working Group (July 1999). This diverse group noted that as a general rule, requiring patient authorization prior to disclosure can:

• bolster patient trust in providers and health care organizations by acknowledging the patient's role in health care decisions;
• serve as recognition that notice was given and the patient was aware of the risks and benefits of disclosure; and
• define an "initial moment" in which patients can raise questions about privacy concerns and learn more about options available to them.

We find the Secretary's current position regarding authorization for treatment, payment, and health care operations to be particularly objectionable because it runs counter to other efforts to make our health care system function properly. In a world of managed care, the Administration and many health and consumer interests have been dedicated to shifting popular culture to embrace the concept of the "empowered patient." Many observers believe that the best way to make managed care work is for patients to become self-advocates and active in working the

system so they get the care they need. Dismantling the current authorization system runs counter to this approach. The Administration's approach disempowers patients by taking away their ability to actively control access to their own protected health information.

Patients should be encouraged to be active participants in their own health care -- and the authorization process should be an integral piece of that picture. The authorization should be renewed at least once every three years, or when the patient changes insurance companies, whichever occurs first. Since entities are already required to provide notice to patients every three years, there would little additional administrative burden. For covered entities that are health plans, authorization can be obtained through the employer or through the insurance company.

Under this model, it may be necessary to allow covered entities to refuse enrollment or services if the patient refuses to sign the authorization. This would be acceptable if the other changes suggested in our comments were included -- such as a genuine right to restrict disclosures and heightened protections for sensitive information.

Again, we urge the Secretary to add an authorization requirement for treatment, payment and health care operations.

2. Treatment, Payment, and Health Care Operations, Section 164.506(a)

Recommendation:

HHS has attempted to make provision for the business needs of covered entities which require them to disclose protected health information in their operations. Section 164.506(a)(1)(i) provides that a covered entity may use and disclose protected health information, "[e]xcept for research information unrelated to treatment, to carry out treatment, payment, or health care operations." Health care operations is defined at 164.504 to include "[c]onducting quality assessment and improvement activities" and "[r]eviewing the competence or qualifications of health care professionals." However, the commentary to the definition of "health care operations" states that "a health care operation should not result in protected health information being disclosed to an entity that is not the covered entity (or a business partner of such entity) on whose behalf the operation is being performed." It should be made clear that in some circumstances, an employee representative is a business partner involved in health care operations to which protected health information may be disclosed.

Rationale:

The access of most employee representatives to protected health information will be covered by Section 164.510(n), Uses and disclosures otherwise required by law. However, in some state and local jurisdictions, a collective bargaining law does not regulate the relationship of employer to employees. In some of those jurisdictions, employers, including covered entities, have voluntarily entered into relationships with a representative chosen by their employees. Those relationships in some instances will resemble the relationship of employer to employee representative mandated by such laws as the National Labor Relations Act or state collective bargaining laws, although the employers are not covered by those laws. Thus, the employee representative will be given access to information maintained by the employer when it is necessary to the fulfillment of the representative responsibilities to the workforce.

In addition, in some instances, even where the employer/employee representative relationship is governed by federal or state law, the employer and its workforce representative have chosen to go further than the obligations to each other that are mandated by those laws and have entered into partnerships to improve the quality of care and services provided. In such partnerships the union becomes a partner in quality assessment and improvement activities, which are defined by the subpart as a component of health care operations.

Under such circumstances the employee representative functions as a "business partner" of the covered entity and should be entitled to access to protected health information as are other business partners. Although the definition of business partner is broad, there is no recognition of the possibility of employee representatives serving in such roles. Where protected health information is necessary to the employee representative so that the representative can assist with the performance of activities such as quality assessment and improvement activities and activities to review the competence or qualifications of health care professionals, it should be clearly permitted.

3. Prohibition on Seeking Authorization for Uses and Disclosures for Treatment, Payment and Health Care Operations

Recommendation:

We prefer that the regulations include an authorization requirement for treatment, payment and health care operations. If the regulations do not include this requirement, we suggest that the final regulations, at a minimum, allow entities to have the option to require patient authorization for treatment, payment and health care operations.

Rationale:

Under proposed section 164.508(a)(2)(iv) a covered entity is prohibited from requiring an individual to sign an authorization for use or disclosure of protected health information for treatment, payment, or health care operations purposes. The explanation of this provision also indicates a broader intent to prohibit covered entities from "seeking individual authorization" for these listed purposes. 64 Fed. Reg. 59941 (Nov. 3, 1999). Given this expansive language, section 164.508 may be construed in an unduly broad fashion. We are concerned that:

A general prohibition on health care providers from "seeking individual authorization" may deter health care providers from initiating discussions with patients concerning their rights under section 164.506(c) to request restrictions on the uses or disclosures of protected health information for treatment, payment or health care purposes; and

Health care organizations have a legitimate interest in collecting patient authorizations and should be permitted to require patient authorization for treatment, payment and health care operations.

Today, health care providers routinely require patient authorizations prior to disclosing protected health information for many purposes. For example, patient authorizations are used as a mechanism for determining what health information to release for purposes of second opinions, consultations, and referrals. Under current procedure, a patient, usually in consultation with a health care provider, will complete a form authorizing the disclosure of his or her health information to another health care provider for second opinions, referrals and consultations. In the form, the patient usually designates both the type and scope of the information to be disclosed and to whom the information is to be disclosed. These authorizations provide meaningful guidance to the initial provider in determining what records to release. The provider may also retain a copy of the authorization in case of a legal dispute.

Furthermore, such authorizations provide the patient with some degree of control over what information is disclosed and to whom it is released. Ultimately, it may help the patient to determine who is in possession of his or her medical records.

We suggest that the explanation of section 164.508 be revised to clarify that a covered entity may require an individual authorization to restrict the use or disclosure of health information for the purposes of treatment, payment and health care operations.

4. Scope of "Treatment and Payment"

Recommendation:

The terms "treatment" and "payment" should be narrowly construed as encompassing only the treatment and payment related to the individual who is the subject of the information.

Rationale:

Draft section 164.506 would allow covered entities to use and disclose protected information without an individual's authorization for the purposes of treatment and payment. The Secretary intends that this provision be interpreted "to apply for treatment and payment of all individuals."

One of the Secretary's justifications for this broad interpretation is that treatment and payment are core functions of the health care system and that "[t]his is what individuals expect their health information will be used for when they seek medical care."

To the contrary, individuals seeking medical care expect that their health information will be used for their own treatment and payment. Many people would be mortified to learn that their health information was being reviewed for the treatment of others -- particularly people they know. We find particularly disturbing the Secretary's examples of permissible uses without the individual's consent, such as the review of the records of family members or house mates. When a physician is examining the information of a small group of individuals known to the patient, such as family members or house mates, the risk of inadvertent disclosure of identifiable data to the patient is not insignificant. When dealing with such a small group, patients easily would be able to surmise the identity of those whose information has been reviewed, as well as their health status. Individuals should have the ability to decide whether they want to accept the risk of disclosure by allowing their medical information to be used for the treatment of someone they know.

We recognize there may be legitimate circumstances where a provider may want to review the health information of the patient of another provider. We believe these circumstances would be limited, however, and that it would not pose a substantial burden on providers to request authorization for these purposes. We encourage the Secretary to construe "treatment" and "payment" in a narrow manner as applying to the treatment and payment of the individual who is the subject of the health information. Uses and disclosures for the treatment and payment of others should be permitted only with the authorization of the individual.

This suggested approach of construing "treatment" and "payment" in a limited fashion is endorsed by many states that generally prohibit disclosures without the patient's authorization but make an exception for disclosures to providers who are treating the patient who is the subject of the protected health information. See e.g., Ariz. Rev. Stat. sec. 12-2294 (allowing the disclosure of a patient's medical records without a signed authorization to attending and consulting health care providers who are currently providing health care to the patient for the purpose of diagnosis or treatment of the patient) (emphasis added); Md. Code Ann. Health-Gen. sec. 4-303 ( allowing disclosures to another health care provider for the sole purpose of treating the patient or recipient on whom the medical record is kept); Fla. Stat. Ann. sec. 455.667 (prohibiting the disclosure of medical records to anyone other than the patient, his representative, or other health care practitioners and providers involved in the care or treatment of the patient except upon written authorization of the patient) (emphasis added); Cal. Health & Safety Code sec. 56.10(c)(1) (permitting medical information to be disclosed to other providers of health care "for purposes of diagnosis or treatment of the patient") (emphasis added). We note that even the examples cited by the Secretary in her explanation permit disclosures only to providers "treating the individual" or to "a person who is providing health-care to the patient." 64 Fed. Reg. 59941 (Nov. 3, 1999).

We urge the Secretary to adopt this approach and to construe "treatment" and "payment" as applying to the treatment and payment of the individual who is the subject of the health information.

5. Verification of Identity of Requesters of Information

While we prefer that issues of verification be addressed through an authorization process that involves the patient, we endorse section 164.518(c)'s general requirements that covered entities have procedures for verifying the identity of the requester of protected health information. We believe that section 164.506 should incorporate this requirement.

Recommendation:

Section 164.506 should have a provision expressly requiring covered entities to comply with the applicable verification requirements under section 164.518(c).

Rationale:

Under proposed section 164.506, it appears that providers are permitted to disclose protected health information to other providers for consultation or referral without verifying the identity of the provider who has requested protected information. Because providers who disclose to other providers for consultation or referral purposes are not subject to the business partner rules in section 164.506(e) and covered entities are prohibited from obtaining individual authorizations under section 164.506 (see p. 59941), providers are given blanket authority to disclose protected health information for treatment, payment and health care operations about a patient without knowing whether the person who has requested the information is actually (1) a provider and (2) treating that particular patient or has another valid reason for requesting the patient's records. We recommend that the verification procedures set forth in section 164.518(c) apply to uses and disclosures for treatment, payment and health care operations.

Section 164.518(c) generally requires covered entities to have adequate procedures for verifying that the individual or person making the request for protected health information has the appropriate identity for the use or disclosure requested, except in specified circumstances. The Secretary's explanation of the regulation indicates that for most categories of permitted disclosures, when the request for disclosure of protected health information is from a person with whom the covered entity does not routinely do business, the covered entity would be required to verify the identity of the requestor. It is clear from the language of section 164.518(c) and the Secretary's explanation of this provision that the verification procedure was intended to apply to section 164.510 requests (made pursuant to the "public policy" uses and disclosures permitted without individual authorization). Furthermore, section 164.510(a)(1) itself expressly incorporates this verification requirement and requires covered entities to comply with any applicable verification requirements under section 164.518(c) as a condition of using or disclosing protected health information without the individual's authorization.

In contrast, it is unclear whether these verification procedures apply to section 164.506 requests (made pursuant to the provisions allowing use and disclosure for treatment, payment and health care operations without individual authorization), even where the request for information originates from an unfamiliar source outside the covered entity. The language of section 164.518(c) is general and somewhat ambiguous. The Secretary's explanation of section 164.518(c), while general enough to encompass section 164.506 uses and disclosures, does not directly address uses and disclosures for treatment, payment and health care operations. Furthermore, unlike section 164.510, section 164.506 does not expressly incorporate the verification requirements under section 164.518. Consequently, it is at least arguable that the regulations do not impose the 164.518 verification requirements on 164.506 disclosures even when the request originates from an unfamiliar source outside the covered entity.

Although the rules in section 164.506(e) would afford some protection for disclosures to business partners by requiring contracts that ensure that the business partner will safeguard information that it receives, these rules expressly exclude disclosures from provider to provider for consultation or referral purposes. In sum, there appear to be no verification rules or other checks on provider-to-provider disclosures under section 164.506.

Presumably, the Secretary considers provider-to-provider uses and disclosures for consultation or referral to pose less of a risk of unwarranted disclosure than other uses and disclosures. We believe, however, that provider-to-provider disclosures for consultation and referral can pose a significant risk of unwarranted disclosure. Consider this scenario: a woman seeks specialized treatment for reproductive health services, or mental health services. If another provider requests information, the provider who rendered the services would not have to consult the patient before the disclosure or even verify who has requested the information. Of particular concern is that this loophole would be used by people who are not providers to obtain information under false pretenses on patients.

While many providers may argue that the requirements of 164.518(c) create additional administrative burdens, we believe that these verification procedures are reasonable, and the only situation in which providers would have additional administrative burdens is when the identity of the provider requesting the information is unknown--where the risk of inappropriate disclosure is the greatest. Those providers that have ongoing relationships would obviously know the requestor and not be required to conduct additional verification.

We recommend the following addition to 164.506(a):

(a) Standard. A covered entity may not use or disclose an individual's protected health information, except as otherwise permitted or required by this part or as required to comply with applicable requirements of this subchapter. In using or disclosing protected health information under this section a covered entity must comply with applicable verification requirements under section 164.518(c).

6. Exception For Psychotherapy Notes

We commend the Secretary for accepting in principle the need to limit access to psychotherapy notes, absent specific consent from the individual. However, without additional protections this provision at best provides only very limited privacy protection.

Recommendation:

The rule should make clear that it is the information that is being protected, not just the specific "notes" themselves.

Rationale:

The protection for notes will not be meaningful if the same information can be demanded in a

different format. We are also concerned by the likely expansive interpretation of the notes' definition which might allow plans and others to require the release of verbatim notes. For this reason we believe that the explanatory text should specify that demands for verbatim notes are not permitted and that the amount of information that is excluded from the patient consent requirement narrowed dramatically.

7. Exception for Psychotherapy Notes

Section 164.510 Disclosures

Recommendation:

The limitations on disclosure of psychotherapy notes should extend throughout the regulation. In particular, there should be a prohibition on disclosure of psychotherapy notes for the activities addressed in section 164.510.

Rationale:

The proposed regulation only affords heightened protections for purposes of treatment, payment, and health care operations. In all other circumstances, the notes may be used or disclosed in the same manner as all protected health information. Under the proposed regulation, for example, the notes may be used or disclosed for public health reporting, to next of kin, for directory information, and to law enforcement.

There is no good rationale for psychotherapy notes to be shared, unless the individual has authorized the use or disclosure. Psychotherapy notes include extremely sensitive information, and if individuals are aware that such information can be shared so widely, it will likely destroy the therapeutic relationship.

8. Exception for Psychotherapy Notes

Interaction with Common Law

We also call to your attention the need for a provision which requires section 164.510 disclosures be consistent with the psychotherapist-patient privilege first established by Jaffe v. Redmond. Nor should the regulations modify "duty to warn" case law or statutes which, under certain circumstances, require the disclosure of medical information when a specific threat has been made to a person's safety.

MINIMUM NECESSARY

Section 164.506(b)(1) Standard: Minimum Necessary.

Summary

We support the general rule in the proposed regulation that organizations "must make all reasonable efforts not to use or disclose more than the minimum amount of protected health information necessary to accomplish the intended purpose of the use or disclosure." We are particularly pleased that the minimization requirement extends to treatment, payment, and health care operations.

This rule does not apply in the following circumstances:

• When the individual requests that a disclosure be made to a third party
• When the individual requests access to his or her own health information
• For enforcement of the rule
• Made by a covered health care provider to a covered health plan for audit and related purposes
• When required by law and permitted in section 164.510.

We believe that the only appropriate exception to the minimization requirement is when an individual requests access to his or her own information. In all other circumstances, the minimization requirement should apply for all uses and disclosures.

We recognize, however, that because the proposed rule only covers certain entities, it may not always be possible for the covered entity to make a determination as to what information is necessary to accomplish the purpose of the disclosure. In some circumstances - such as health care oversight - there may even be a conflict of interest in disclosing the data.

The proposed rule resolves this tension by exempting certain activities from the minimization requirement. These exceptions, however, are particularly broad, particularly with regard to disclosures allowable under section 164.510. In practice, it would mean that a large number of uses and disclosures would not be subject to the minimization requirement. These activities include health oversight, law enforcement, directory information, judicial and administrative proceedings, research, next-of-kin, and many others.

Our comments identify those areas where we feel that the minimization requirement is

appropriate and should be applied in the context of the proposed regulation. We still believe, however, that a universal minimization requirement is essential, and should be enforced through a comprehensive federal health privacy law.

Finally, our comments identify circumstances where we believe that the entity requesting information should be held to a minimization standard. In these cases, the disclosing entity could rely on the decision of the requesting entity, without losing accountability.

Note: The proposed rule establishes the general minimization requirement in section 164.506 (b) (1) and includes a list of exceptions. In our comments we do not suggest amending this section, but adding additional requirements to the individual sections included as exceptions to the minimization requirement. However, the same result could be achieved by narrowing the exceptions to the minimization rule outlined in section 506 (b) (1).

1. Duty to Request The Minimum Necessary

Recommendation:

Where the disclosing entity does not have the ability to determine the minimum amount necessary, the covered entity requesting the information should only be permitted to request the minimum amount necessary to accomplish the purpose of the disclosure.

Rationale:

There are a number of circumstances where the entity disclosing data is expected to assume that the amount requested in the minimum amount necessary. There is no requirement in the proposed rule, however, for the entity requesting data to request only the minimum amount necessary. In such circumstances, therefore, there will be no guarantee that the minimum amount of information will be shared.

The proposed rule should address this issue by requiring that the entity requesting data - if they are a covered entity - be required to request only the minimum amount necessary to accomplish the purpose of the disclosure.

2. Disclosures at The Individual's Request

Recommendation:

When a covered entity discloses protected health information at the individual's request, they should limit the disclosure to the minimum amount necessary, unless the individual has indicated otherwise.

Rationale:

The proposed regulation distinguishes between an authorization made at the request of an individual, and an authorization made at the request of a covered entity. If the individual makes the request, the covered entity is not bound to the general minimization requirement. In practice, then, a covered entity could disclose more information than the individual intended.

We believe that the minimization requirement should be extended to circumstances when the individual requests a covered entity to make a disclosure. If the individual wants all protected health information released, that can be specified in the authorization.

3. Judicial And Administrative Proceedings

Recommendation:

Where a request for protected health information is not accompanied by a court order, the covered entity should only be permitted to disclose the amount of information requested.

Rationale:

The proposed rule specifies that in the case of judicial and administrative proceedings, "[w]here the request for disclosure of protected health information is accompanied by a court order, the covered entity may disclose only that protected health information which the court order authorizes to be disclosed." Section 164.510 (d) (3) (i). However, if the request is not accompanied by a court order there is no requirement that only the amount requested be disclosed. We believe that only the amount reasonably necessary to respond to the request should be disclosed.

4. Law Enforcement

Recommendation:

Sections 164.510 (f) (3 and 5) should be revised to ensure that these disclosures are limited to the minimum amount necessary to accomplish the purpose of the disclosure.

Rationale:

The proposed rule somewhat limits the amount and type of information available to law enforcement. There are some circumstances, however, where law enforcement officials would have access to all parts of the medical record, without a meaningful review process.

Law enforcement access to protected health information for information about a victim of crime or abuse, and for health care fraud, should be subject to the minimum amount necessary to accomplish the purpose of the disclosure.

5. Next of Kin

Recommendation:

Disclosures to next of kin should be restricted to the minimum amount necessary to accomplish the purpose of the disclosure, and restricted to information relevant to the current medical condition.

Rationale:

The proposed rule allows for disclosures to next-of-kin if the individual has verbally agreed to the disclosure. There is no guidance, however, as to how much, or what kind of information can be disclosed. Since the agreement in this instance will be a verbal agreement, it is especially important to insure that only the minimum amount of information necessary is disclosed, and only that information relevant to the current medical condition.

In other words, the verbal agreement to disclosure to next of kin should be understood to mean information about the present medical condition at issue, unless the individual has given specific permission to disclose additional information.

This approach was taken in some of the comprehensive health privacy bills considered in the 106th Congress. S. 578, co-sponsored by Senators Jeffords (R-VT) and Dodd (D-CT), for example, allows information to be shared with next of kin if "the information disclosed related to health care currently being provided to that individual." S. 578 § 204 (a) (2).

6. Limit Section 164.510 Disclosures to Amount Requested

Recommendation:

When a covered entity discloses protected health information pursuant to section 164.510, they should be prohibited from disclosing information in excess of the information requested.

Rationale:

We agree that it will sometimes be impracticable for covered entities to determine the minimum amount necessary for the disclosures identified in section 164.510. However, when the covered entity discloses information pursuant to section 164.510, they should only be permitted to disclose the amount of information requested. In Maine, for example, the relevant state law requires that "a health care practitioner or facility that discloses health care information... may not disclose information in excess of the information requested in the authorization." Me Rev. Stat. tit. 22 sec. 1711- C , subsec. 10 as amended by 1999 Me. Laws 512 sec. Ax 5. Where authorization is not required (including disclosures pursuant to subpoenas), the entity "may not disclose information in excess of the information reasonably required for the purpose for which it is disclosed." Id.

RIGHT TO REQUEST RESTRICTIONS

Section 164.506(c) Standard: right of an individual to restrict uses and disclosures.

Summary

We support the general idea behind the regulations' granting individuals the right to request restrictions on the uses and disclosures of protected health information. There are many circumstances where an individual has a legitimate concern that the disclosure of protected health information will result in personal harm or discrimination. Imposing a restriction on the disclosure of protected health information can help alleviate these potential problems. We believe, however, that the right to request a restriction does not adequately address these concerns. The regulations should provide more protection for individuals.

We suggest that the regulations be amended in the following ways:

i. Allow individuals to have a true right to restrict (not just the right to request restrictions on) the use and disclosure of their protected health information where the disclosure of that information could jeopardize the safety of the individual.

ii. Allow individuals who pay for their own medical care (self pay) to have a true right to restrict the disclosure of their protected health information.

iii. Extend the application of this section to all covered entities.

iv. Require all covered entities that receive health care information that is subject to a restriction agreement to comply with the restriction.

1. A True Right to Restrict

Recommendation:

The regulations should include a new provision specifying that individuals have a right to restrict the use and disclosure of their protected health information (not subject to the approval of a covered entity) where the disclosure of such information could jeopardize the safety of the individual.

Rationale:

Victims of domestic abuse need to be able to place restrictions on the use and disclosure of their protected health information even for treatment, payment and health care operations purposes. Victims of abuse need to know that their health information and their whereabouts will be fully protected in order to access health care safely. It is essential that a victim who has fled an abuser not be found because a provider or insurer gives the batterer the victim's new address, either directly or through the mailing of an explanation of benefits form. A victim's right to restrict the disclosure of protected health information should not be dependent on the agreement of a health care provider, who may underestimate the severity of the danger. Failing to give victims of abuse a true right to limit disclosures of information, where the disclosure would endanger their safety, will undermine the efforts of the health care community to serve victims of abuse and deprive them of necessary care and assistance.

HIPAA recognizes the special needs of victims of domestic violence by specifically including conditions resulting from abuse as a prohibited underwriting consideration. The draft regulations also recognize the need of victims of abuse for special protection against the disclosure of their

whereabouts by providing protection against such disclosures in the section 164.510(h) relating to directory information and discussion at page 59965. However, as discussed above, the confidentiality needs of victims of abuse extend beyond the need to limit directory information.

Granting individuals the true right to restrict the disclosure of their protected health information to protect their safety is not a novel concept. The 1998 Health Information Privacy Model Act adopted by the National Association of Insurance Commissioners (NAIC) takes this approach. See Health Information Privacy Model Act, sec. 14.A. The NAIC, the association of state insurance regulators, adopts model laws only after obtaining extensive input from all interested parties. In the case of this privacy model, the NAIC deliberated over several years, holding numerous meetings at which insurers and consumers provided extensive comment and engaged in lengthy negotiation. This model and the particular provision which we ask the Secretary to include in the regulations can therefore be considered to be the result of a consensus, to which numerous participating health plans and members of the insurance industry agreed. We suggest that the Secretary adopt the approach taken by NAIC's Model Act.

Specifically, we recommend that the Secretary add the following subsection to section 164.506:

Standard: Right of an individual to restrict the use and disclosure of protected health information where disclosure could jeopardize the safety of the individual.

(a) An individual has the right to restrict the disclosure of his or her protected health information by communicating in writing to a covered entity that the safety of the individual could be jeopardized by:

(1) disclosures to specified individuals ; or

(2) contacting the individual in specified manners.

(b) A covered entity may not disclose protected health information inconsistent with the restriction under paragraph (a) of this section. Such restrictions may include, but are not limited to, prohibiting the release of any information to a spouse to prevent domestic violence, and restrictions on the mailing of appointment notices to the individual's home, calling the home to confirm appointments, and mailing an explanation of benefits to the individual or to the policyholder. If the individual places restrictions on the manner in which the covered entity may communicate with the individual, the covered entity may ask the individual to provide a phone number or an address for such communications and may require the individual to indicate how payment will be arranged if payment is due.

2. Self-paying Individuals

Recommendation:

We believe that the right to request restriction agreements should continue to be available to all individuals. In addition, the regulations should include a new provision specifying that an individual who pays a health care provider directly for health care services has the right to restrict the use and disclosure of health care information related to such services, and that such right is not subject to the approval of the health care provider.

Rationale:

The Secretary has indicated that she considered limiting the right to request restrictions on disclosures to patients who pay for their own health care. 64 Fed. Reg. 59946. At a bare minimum, we believe that all individuals, not just those who self-pay, should have a right to request restrictions.

Additionally, we believe that individuals who self-pay should have the true right to restrict the use and disclosure of their protected health information. Some individuals have opted to pay for treatment for certain medical conditions themselves rather than take the risk that their insurance company or their employer will learn of these conditions and take adverse actions against them. This approach, while not ideal, allows people to get the treatment they need while controlling the possibility of discrimination based on health condition. We believe that individuals who self-pay for their health care should have the ability to control the use and disclosure of the related health information. This is particularly true in a regulatory system such as the one proposed that would allow an individual's health information to be freely used for the treatment and payment of others.

We propose that the regulations include a new provision that allows patients who self-pay for their health care to restrict the use and disclosure of the related health care information. The decision to restrict should be made solely by the individual and should not be subject to the agreement of the health care provider. The ability to restrict disclosures for payment is a natural consequence of self-paying. We believe an individual should also be able to restrict the use and disclosure of protected health information for treatment purposes given the Secretary's intention that information generally may be used for treatment of all individuals without the subject's consent.

Hawaii, which recently enacted a comprehensive privacy of health care information law, adopted this approach and allows individuals who self-pay to restrict the disclosure of their health care information. See Haw. Rev. Stat. § 323C-21(c). We suggest that the Secretary adopt the approach taken by Hawaii's health privacy law and add the following subsection to section 164.506 :

Standard: Right of an individual to restrict uses and disclosures of protected health information related to health care services paid for directly by the individual.

If an individual does not want protected health information used or disclosed for the purposes of treatment, payment, or health care operations, the individual shall advise the health care provider prior to the delivery of services that the relevant protected health information shall not be disclosed for these purposes pursuant to section 164.506(a)(1)(i), and the individual shall pay the health care provider directly for health care services. Protected health information related to health care services so identified and paid for directly by the individual shall not be disclosed for purposes of treatment, payment, or health care operation purposes without the individual's authorization.

3. Application to All Covered Entities

Recommendation:

We urge the Secretary to expand the application of this section to all covered entities.

Rationale:

As discussed above, we believe that individuals should have a true right to restrict the disclosure and use of their protected health information in certain circumstances. Whether the Secretary adopts our suggested approach or maintains the current regulatory framework of only allowing individuals to request restrictions on disclosures, we believe, at a minimum, that the restriction requirements should apply not only to health providers, as currently specified in section 164.506(c)(1)(i), but also to health plans.

The disclosure of protected health information may pose a harm to the individual, regardless of the source of that disclosure. There are circumstances in which it is appropriate to request not only a health provider but also a health plan to restrict disclosures of protected health information. In light of NAIC's 1998 Health Information Privacy Model Act it appears the health insurance industry and the NAIC have already reached a consensus that health plans may be required to restrict the disclosure of health information.

4. The Restriction Should Follow The Protected Health Information

Recommendation:

Require all covered entities that receive health care information that is subject to a restriction to comply with the restriction.

Rationale:

Under the proposed regulations, it appears that only the original health care provider is required to comply with the restriction agreement. See 164.506(c). Although the covered entity entering into such an agreement is required to notify those to whom such information is disclosed of such restriction there is no requirement that a covered entity receiving the information comply with the restriction. § 164.506(c)(2)(iv). A restriction that does not follow the information would be of limited value. The Secretary clearly has the authority to impose a duty to comply with the restriction on a covered entity receiving such information. We recommend that such a provision be added to the regulations.

BUSINESS PARTNERS

Section 164.506(e) Standards: business partners.

Recommendation:

We oppose the requirement that covered entities be accountable for the uses and disclosures of protected health information by their business partners.

Rationale:

ANA understands the attempt to fill a gap in authority by extending the standards to covered entities' business partners through contracts. However, this requirement that health care providers police others, whose behavior they cannot control, is inherently unfair. The fact that there is insufficient statutory authority to apply the regulation to all entities who should be covered is not a acceptable reason for "kicking it to fit," at the expense of practitioners who cannot reasonably carry the required burden and should not be required to. Covered entities may be required to select reputable business partners, to disclose information to them in a responsible manner, and may even have contracts that specify the expectation that the business partner will comply with the requirements of the law. But the covered entity's liability should end there; practitioners cannot control all acts of their business partners. If a business partner violates the requirements of the proposed regulations, the covered entity may not be in a position to mitigate the violation or terminate the contract as required under the proposed regulations. If a business partner violates its contract with a covered entity, the covered entity should be shielded from any liability for the inappropriate use or disclosure of protected health information.

ANA believes that this problem demonstrates the need for comprehensive Federal legislation on the entire issue of health care privacy and confidentiality. A requirement under HIPAA for regulations to safeguard electronic records is simply too thin a basis for properly addressing this most complex and vexing issue. Federal law should mandate that the privacy of the health information is the responsibility of any entity handling the information in the course of business..

Business partners are often larger and more sophisticated than many practitioners with which they have relationships. The business partner arrangement does not adequately address the current complexity of health care. Arrangements are not only made among providers, patients, and payers but among a whole host of other entities such as pharmacy benefits management organizations and home health companies. To categorize these relationships and corporate networks as business partners implies a degree of autonomy that simply no longer exists and ignores the intricacies involved. These relationships are more likely to be the product of giant corporations and not contractual agreements whereby providers elect to outsource administrative tasks.

ADHERENCE TO NOTICE

Section 164.506(g) Standard: uses and disclosures consistent with notice.

Recommendation:

We support the regulations' requirement that covered plans and providers adhere to the statements reflected in the notice of information practices.

Rationale:

Such a notice is meaningless if a covered entity does not actually follow the practices outlined in its notice. Many of our members work have experience with organizations that have written policies and procedures governing the confidentiality of occupational health records. Despite that, there are instances in which the organization fails to follow those policies. A statute giving legal weight to existing policies would help alleviate this situation.

COMPONENT ENTITIES

Section 164.506 Uses and disclosures of protected health information: general rules.

We urge the Secretary to amend the proposed regulation to expressly provide that, with respect to persons or organizations that provide health care or have created health plans but are primarily engaged in other unrelated activities, the term "covered entity" encompasses only the health care component of that entity. She also should add language to the regulation itself making it clear that effective fire walls must be set up between the health care component units of an employer (e.g., the employee health benefits plan administrative group and the occupational health department) and the rest of the company so that protected health information cannot fall into the hands of personnel responsible for making job determinations.

INDIVIDUAL AUTHORIZATION

Section 164.508 Uses and disclosures for which individual authorization is required.

SUMMARY

We support the regulations' requirement that covered entities obtain an authorization from the individual for most uses and disclosures that are not directly related to treatment, payment or health care operations. We strongly agree with the regulation's prohibiting covered entities from conditioning the provision of treatment or payment on the individual's delivering an authorization for use or disclosure. Furthermore, we support the Secretary's intent that uses and disclosures of protected health information be consistent with the purposes stated in the authorization, and we suggest that the regulations be revised to expressly provide that a covered entity and its business partners may use or disclose protected health information only for the purpose specified in the authorization. We also recommend that covered entities be required to obtain individual authorization prior to making certain disclosures of information pertaining to an individual's request or receipt of sensitive health services.

1. Individual Authorization For Purposes Other Than Treatment, Payment or Health Care Operations

Recommendation:

We encourage the Secretary to retain provisions of the proposed regulations that require covered entities to obtain an authorization from individuals for most uses and disclosures of protected health information that are not directly related to treatment, payment, or health care operations.

Rationale:

We agree with the Secretary that most individuals do not anticipate many other uses of their health information, such as marketing purposes, when they obtain health care. Furthermore, information which is being used or disclosed for purposes other than the core health-related purposes is more likely to end up in the hands of entities that are not subject to the protections afforded by the regulations. Thus, it is appropriate that the individual be both notified and consent to the potential use and disclosure of protected health information for these purposes. The requirement for individual authorization for uses of health information not directly related to the care of the patient is supported by state law. See 1999 Cal Stats. ch. 526 sec. 2 (generally requiring a patient's authorization for sharing, selling or using medical information for any purpose not necessary to provide health care services to the patient); Haw. Rev. Stat. §323C-23 (requiring a separate authorization for disclosures of health information other than for treatment, payment or qualified health care operations purposes).

2. Prohibition on Conditioning Treatment or Payment on Authorization

Recommendation:

We strongly support the regulations' prohibition on covered entities from conditioning the provision of treatment or payment on the individual's authorization for use or disclosure of protected health information.

Rationale:

Covered entities should not be allowed to coerce individuals into signing authorizations for disclosures that are not necessary for treatment, payment or health care operations. Recognizing this potential abuse, California prohibited such coercive activities in its recent amendments to the Confidentiality of Medical Information Act. See 1999 Cal. Stats. ch 526 sec. 9 (prohibiting providers and plans from conditioning the receipt of health care services on the individual's signing an authorization or release of medical information).

3. Use And Disclosure Should Be Limited to The Purpose Specified in The Authorization

Recommendation:

The regulations should expressly provide that a covered entity and its business partners may only use or disclose protected health information for the purpose specified in the authorization.

Rationale:

Under the proposed regulations, when a covered entity asks an individual to sign an authorization, it must provide on the authorization form a statement that identifies the purposes for which the information is sought. The preamble states that "[c]overed entities and their business partners would be bound by the statements provided on the authorization, and use or disclosure by the covered entity inconsistent with the statement would constitute a violation of this regulation." It appears that this intended requirement was not incorporated in the actual text of the regulations.

Section 164.506 (a)(1)(ii) generally provides that a covered entity is permitted to use or disclose an individual's protected health information "pursuant to an authorization by the individual that complies with §164.508," but does not expressly impose a requirement that the covered entity use or disclose the information solely in accordance with the purposes stated in the authorization. Neither does section 164.508 have such an express requirement. In order to avoid any possible ambiguity, we suggest that the regulations expressly provide that covered entities and their business partners may only use or disclose protected health information for the purpose specified in the authorization.

4. Separate Authorization For Specific Disclosures of Protected Health Information Involving Sensitive Health Care Services

Recommendation:

The regulations should require a covered entity to protect against inadvertent disclosures of protected health information concerning sensitive health care services (defined as services relating to reproductive health, sexually transmitted diseases, substance abuse, and mental health) by obtaining the individual's authorization prior to communicating with the individual (or the policyholder) at the individual's home (whether by phone or by mail).

GOVERNMENTAL HEALTH DATA SYSTEMS

Section 164.510(g) Disclosures and uses for governmental health data systems.

Summary

We understand the need of legitimate governmental health data systems for patient information. We are concerned, however, that the current language of the regulations would permit disclosure of protected health information for purposes wholly unrelated to health care. We are also concerned that, due to the limits of HIPAA, governmental health data systems are not subject to the current privacy regulations. We urge Congress to take action to a close this gap in the protection afforded to identifiable health information.

1. The Scope of Permissible Purposes

Recommendation:

Section 164.510(g) should be amended to permit disclosures only to governmental health data systems that collect health data for health care related purposes.

Rationale:

In the preamble, the Secretary explains that she proposes to permit covered entities to disclose protected health information for inclusion in State or other governmental health data systems when such disclosure is authorized by law for analysis in support of policy, planning, regulatory and management functions. 64 Fed. Reg. 59964. The Secretary then explains that she "believe[s] that Congress intended to permit States . . . To operate health data collection systems for analyzing and improving the health care system." Id. (Emphasis added.) We believe that allowing disclosures for these limited purposes is the correct approach. The draft regulations, however, do not carry out the Secretary's apparent intent to limit disclosures to government health data systems who will use the data for health care (or health care system) purposes.

Section 164.510(g) allows a covered entity to "disclose protected health information to a government agency, or a private entity acting on behalf of a government agency, for inclusion in a governmental health data system that collects health data for analysis in support of policy, planning, regulatory, or management functions." (Emphasis added.) The type of policy, planning, regulatory or management function is not at all qualified or limited by the regulation. The unqualified language of the proposed regulation is so broad as to allow disclosure to countless federal and state agencies with no direct health responsibilities. For example, the police could qualify to obtain all identifiable patient data for a database designed to help the police make decision about management of the use of police resources near a health care facility. This regulatory provision, which grants free access to protected health information, should not create a mechanism whereby government agencies can effectively circumvent the standards that they would otherwise have to meet to obtain this protected information.

To alleviate this potential problem, section 164.510(g) should amended as follows:

(g) Disclosures and uses for governmental health data systems -

(1) A covered entity may disclose protected health information to a government agency, or private entity acting on behalf of a government agency, for inclusion in a governmental health data system that collects health data for analysis in support of health care related policy, planning, regulatory, or management functions authorized by law.

(2) Permitted uses. Where a covered entity is itself a government agency that collects health data for analysis in support of health care related policy, planning, regulatory, or management functions . . .

2. Scope of The Regulations

Recommendation:

Congress should enact comprehensive health privacy legislation applying to all entities that generate, receive or transfer protected health information.

Rationale:

Under the terms of HIPAA, these privacy regulations may only apply to health plans, certain health providers, and health care clearinghouses. Governmental health data systems do not fall in any of these categories and therefore are not subject to the restrictions contained in the proposed regulations. These systems collect a wealth of protected health information and should be subject to federal protections. We recognize that the Secretary can not currently act in this area and we urge Congress to pass legislation closing this gap in coverage.

DIRECTORY INFORMATION

Section 164.510(h) Disclosures of directory information.

We support the general rule that health care providers may disclose protected health information for directory purposes only where the individual has agreed to such disclosure. We encourage the Secretary to change the language of the preamble to clarify the that minors who lawfully obtain health care services without parental involvement have the right to decide whether their information may be released for directory information purposes.

Recommendations:

• Delete from the preamble discussion of the next-of-kin section (page 59973) the following statement: "The proposed definition of 'individual' addresses related disclosures regarding minors and incapacitated individuals."

2. Add to the preamble at page 59935 the following explanation:

c. Disclosures pertaining to minors. In general, because the definition of individual would include parents, a parent, guardian, or person acting in loco parentis could exercise the rights established under this regulation on behalf of their minor (as established by applicable law) children. However, in cases where a minor lawfully obtains a health care service without the consent of or notification to a parent, the minor would be treated as the individual for purposes of exercising any rights established under this regulation with respect to protected health information relating to such health services. For example, a minor who lawfully obtains a health care service without parental involvement would have the rights of the "individual," guaranteed under sections 164.510(h) and 164.510(l), to agree or object to the release of directory information or disclosures to next-of-kin pertaining to care received without parental involvement. . . .

Rationale:

It is our understanding that the definition of "individual," including its treatment of minors, applies throughout the rule wherever the term "individual" is used. We are concerned, however, that one isolated reference in the preamble (page 59973) to the applicability of the definition of "individual" in one specific context may raise the inference that this definition may not apply in other contexts. As a result, we recommend that this one statement in the preamble be deleted and that the preamble include the explanatory language above.

BANKING AND PAYMENT PROCESSES

Section 164.510(j) Disclosures for banking and payment processes.

The draft regulations provide that only the minimum amount of protected health information necessary be used or disclosed to complete a banking or payment activity. We believe that this is the correct approach. Additional information is not needed for these purposes. However, since banks and financial institutions fall outside the scope of these regulations, we urge Congress to pass comprehensive health privacy legislation that limits the uses and further disclosures of even this minimal amount of protected health information by financial institutions.

With the growing ability to manipulate data through computerization, we are concerned that financial institutions may use even this minimal protected health information for making financial decisions. For instance, a financial institution may be able to identify an individual who has paid for treatment by an oncologist and deny the individual a mortgage based on that information. We realize that financial institutions are beyond the scope of the Secretary's authority, and that only Congress can impose restrictions on the uses that a financial institution can make of protected health information obtained through the payment process.

ADDITIONAL USES AND DISCLOSURES REQUIRED BY OTHER LAW

Recommendation:

In Section 164.510(n), HHS allows covered entities to use or disclose protected health information if such use or disclosure is not addressed elsewhere in Section 164.510, is required by other law, and the disclosure meets all the relevant requirements of such law. An area that is not addressed elsewhere where disclosure is required by other law is the legal obligation of covered entities to disclose information to the collective bargaining representative of their employees. It should be clarified that this legal obligation of covered entities, as regulated employers, is a permitted use and disclosure without individual authorization. We recommend the following addition at the end of Section 164.510(n):

An example of such permitted uses and disclosures is the obligation of covered entities under the National Labor Relations Act, 29 U.S.C. §§ 151 et seq., or state or local collective bargaining laws, to disclose information to the collective bargaining representatives of their employees when such information has been requested by the union to meet its representational responsibilities.

Rationale:

The National Labor Relations Act (NLRA), 29 U.S.C. §§ 151, et seq. provides private sector employees with the right to organize and bargain collectively with their employers and governs the relationship between private employers and the representatives of their non-supervisory employees. An employer who is covered by the NLRA is required to bargain with the representative chosen by its employees with regards to the terms and conditions of employment, including the circumstances under which discipline may be imposed by the employer against a member of its workforce. As recognized by the Supreme Court, employers are obligated under the NLRA to comply with a collective bargaining representative's request for information relevant to these statutory responsibilities. The standard of relevance for this purpose is a liberal "discovery-type" standard. See N.L.R.B. v. ACME Industrial Co., 385 U.S. 432, 435-36 (1967). Various states and local jurisdictions have similarly enacted collective bargaining statutes and ordinances in order to provide public sector employees with the right to organize. In many regards, these laws follow these principles of the NLRA.

The National Labor Relations Board (NLRB) has addressed on several occasions the issue of whether an employer must provide the collective bargaining representative requested confidential patient information. The Board has developed a balancing of interests' test. See e.g. Howard University, 290 N.L.R.B. 1006 (1988). Under that test, the Board has held, for example, that "when a dispute arises concerning the discipline of nurses for errors in patient care, and where a particular portion of a patient's chart would be relevant to a grievance concerning such discipline, either to win the grievance or to dissuade the employee from taking her case to arbitration, that the Union's right to such information must outweigh the patient's right of privacy." LaGuardia Hospital-H.I.P. Hospital, Inc. and LaGuardia Association for Registered Nurses, 260 N.L.R.B. 1455, 1982 NLRB LEXIS 981, *42 (1982). However, the Board has limited disclosure of confidential information to that relevant to the matter in dispute and has restricted the union from divulging the information received to only those persons involved in or necessary to the resolution of the dispute in question.

Given the sometimes contentious nature of employer-employee relations and the developed body of law in this area, it is particularly important for HHS to explicitly state that disclosure in accordance with the NLRA and other collective bargaining laws is not unlawful under the proposed rule.

NOTE: The above discussion should also be labeled: "Relationship to State laws" and "Relationship to other federal laws."