COMMENTS ON MEDICAL RECORDS PRIVACY REGULATIONS
(March 30, 2001)

March 30, 2001

U.S. Department of Health and Human Services
Attention: Privacy I
Hubert H. Humphrey Building
200 Independence Avenue, S.W.
Room 801
Washington, D.C. 20201

Subject: Comments on a technical amendment to convert the final Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 through 164, 64 Fed. Reg. 82462 (December 28, 2000) to a rule with request for comments

To Whom It May Concern:

The Cancer Leadership Council (CLC) is a forum for education and advocacy among national organizations concerned with cancer. The CLC, which includes cancer patient organizations, professional societies, and research organizations, strongly supports regulatory and legislative initiatives to protect confidential medical information. We appreciate the opportunity to offer additional comments on the final rule on medical records privacy.

Background

The cancer community is particularly concerned that the final rule on medical records privacy adequately safeguard information without creating undue burdens on health care providers and medical researchers. Quality care for cancer patients depends on open communication between patient and physician, and such communication is facilitated if patients feel confident that their medical records will remain confidential. However, high quality cancer care also depends on the development of new therapies, and cancer advocates are concerned that the medical records privacy may impede the research and development process.

The CLC commends the Department of Health and Human Services (HHS) for the development of a comprehensive set of standards for the disclosure and use of protected health information. The final rule published by HHS responds to the grave concerns of consumers that their confidential medical records are particularly vulnerable in an age when they are stored and transmitted electronically.

Summary

Although we support the final rule, we recommend some modifications that would ensure that the rule protects the privacy of medical records of those with cancer and other serious and life-threatening illnesses. In summary:

• CLC is most concerned about the addition of provisions in the final rule that would permit the release without authorization of protected health information for use in marketing and fundraising activities. These provisions, which were not in the draft rule, stand in direct contradiction to the contention of the drafters that the rule establishes a right to privacy with regard to the information in medical records. Under the final rule, that right to privacy may be breached with impunity by a health care provider who enters into a marketing arrangement with a third party or by a health care institution that decides to undertake its own fundraising effort. This violation of privacy is serious for any patient but may have particularly dire consequences for those with cancer. To prevent these abuses of privacy, the CLC urges that these provisions be deleted and that authorization be required before health information may be used in marketing and fundraising.

• While we applaud HHS for allowing disclosure and use of protected health information for research purposes without authorization if an institutional review board (IRB) or privacy board grants a waiver, we are concerned that IRBs may find this additional review activity a serious burden. We recommend IRBs be provided additional resources for training and other support of this review activity.

• Health care providers and researchers have identified several provisions of the rule that may adversely affect research. The CLC urges modification of the accounting provision to ensure that institutions will allow use of medical records for research, and we recommend legislative action to establish a federal privacy rule that preempts conflicting state laws.

• CLC proposes that all releases of protected health information to law enforcement officials require independent review.

• Because the Health Insurance Portability and Accountability Act (HIPAA) places limits on the entities that HHS may regulate, the CLC recommends legislative action to extend the reach of the regulation to all who disclose or use protected health information. This would eliminate the need for the business associate provisions of the final rule, which could create a significant burden for health care providers.

Uses and Disclosures for Marketing and Fundraising (Sections 164.514(e) and 164.514(f)

The CLC objects to the inclusion in the final rule of provisions that would permit release of protected health information without authorization for use in marketing and fundraising activities. As a result of these provisions, individuals may receive unwanted communications from unknown third parties. Although the fundraising provision limits the type of information that may be released to demographic information about the individual and the dates the individual received health care, the marketing provision contains no such limits.

The receipt of unsolicited fundraising and marketing materials may be personally objectionable to the individual, but of much greater concern is the fact that protected health information will be disclosed to an unknown third party without individual authorization. Disclosures of this sort increase the risk of additional, unauthorized disclosures and uses of confidential health information. In fact, these provisions are contrary to the underlying concept of the final rule - that individuals will have control of their protected health information and any disclosures and uses of it.

The inclusion of so-called opt-out authority in the marketing and fundraising provisions is practically meaningless. Individuals will be able to opt-out of any additional fundraising or marketing solicitations after the initial one, but for individuals with cancer, the harm of disclosure and use may already be done. The final rule is intended to establish an individual right to privacy with regard to the information in medical records, but the marketing and fundraising provisions of the rule will allow routine violations of that right.

Regrettably, a diagnosis of cancer still carries a stigma and may have a serious adverse effect on a person with that diagnosis. Any cancer patient may be susceptible to harm as a result of disclosure of his or her diagnosis and other important health care information, but the impact on a child with cancer may be most dramatic. If the confidential health information of a child with cancer is disclosed for marketing and fundraising purposes and then improperly used by any other party, the consequences for the child could be lifelong. The child with cancer may confront significant long-term effects of diagnosis and treatment, and those side-effects may only be exacerbated by discrimination at school, in access to insurance, and in employment that results from improper disclosure of confidential health information.

The marketing and fundraising provisions were not included in the proposed rule and were included by the Clinton Administration in the final rule without public input. Although the CLC appreciates the opportunity to offer comments on the final rule, the comment period is brief and does not allow adequate opportunity for evaluation of these provisions, which will have far-reaching impact.

The CLC strongly recommends that HHS delete the marketing and fundraising provisions from the final rule. The provisions are flawed substantively, and the procedure by which they were added to the rule is also unacceptable.

Medical Research (Section 164.512(i))

The CLC supports the provisions of the rule that govern the disclosure and use of protected health information for research. It is appropriate to allow the use of health information in research if an IRB or privacy board reviews the research protocol and grants a waiver from the requirement of individual authorization. HHS has identified in the rule those privacy issues that IRBs must consider when reviewing research protocols.

Although we support the specific guidance that the rule offers to IRBs and privacy boards for their privacy reviews, these new review responsibilities will impose a significant new burden on IRBs. Many CLC participants serve as members of IRBs and appreciate the IRBs' responsibilities to patients, researchers, and academic institutions and their very significant workload. Therefore, we believe IRBs can fulfill their new responsibilities under the final rule only if they are provided new resources to train their members on privacy issues and to enhance their administrative systems in response to an increased workload.

The efficient review of research protocols is of utmost concern to the CLC. Delays in clinical cancer research will slow progress in finding new treatments for the disease, and steps must be taken to prevent any such delays.

Accounting of Disclosures of Protected Health Information (Section 164.528)

The CLC has been informed by a number of health providers that they will be reluctant to allow the disclosure of protected health information for research purposes, especially large numbers of records for use in epidemiological and health services research. These institutions indicate that, even if an IRB grants a waiver from individual authorization, they will still be required to provide individuals an accounting for releases of their records, including releases for research. If a research protocol requires release of a significant number of records, the requirement to account for those releases may serve as a disincentive to institutions that would otherwise support the research.

Because IRB approval should provide assurances that medical records privacy will be protected by researchers, the CLC recommends that the accounting requirement be revised to eliminate reporting of disclosures and uses for research. The cancer community has a great interest in seeing that research on possible genetic links to cancer, which may require review of a significant number of records, not be impeded by the medical records privacy rule. The CLC believes that modification of the accounting requirement will accomplish this goal.

Relationship to State Laws

We appreciate that HIPAA does not authorize HHS to promulgate a medical records privacy rule that would preempt state laws. However, the development of a uniform federal approach is so important that we use these comments to urge Congress to enact legislation that sets an absolute federal standard.

As patient advocates, we strongly support measures to safeguard the privacy of medical records. However, of equal concern is the health of the clinical research enterprise. Much cancer clinical research is multi-institutional and occurs in several jurisdictions; therefore, cancer researchers are subject to conflicting state privacy laws. The development of a federal privacy standard presents an opportunity to preempt conflicting state laws and ease the administrative responsibilities of researchers. Without legislative action, the federal standard will only complicate researchers' burden of compliance.

Law Enforcement (164.510(f))

The CLC supports the standard in the rule that would allow disclosure of protected health information to law enforcement authorities pursuant to warrant, subpoena or order issued by a judicial officer. However, we have serious reservations about a provision of the rule allowing disclosure on the basis of an administrative subpoena or summons without independent judicial review. If an invasion of privacy is warranted, independent judicial review should not prove to be an obstacle. CLC recommends that independent review be required for any disclosure of protected health information to law enforcement authorities.

Business Associates (Sections 164.502(e) and 164.504(e))

The CLC strongly recommends that Congress enact legislation that will ensure that all entities that have access to medical records be subject to federal standards governing the use and disclosure of those records. We appreciate that HIPAA limits the application of the rule to health care plans, health care providers, and health care clearinghouses. However, this limitation results in serious gaps in the protection of individuals' health records.

HHS has sought to expand the reach of the rule by requiring that covered entities enter into contractual agreements that would mandate that their business associates meet the standards in the rule. CLC does not believe this is an appropriate solution to the limits imposed by HIPAA. Covered entities understandably object to the requirement that they be responsible for enforcing compliance with privacy rules by non-covered entities, and consumers are vulnerable to inappropriate uses of their records by those entities that are not technically covered by the rule.

CLC strongly encourages prompt legislative action on this issue, but because such action may be delayed, we propose that in the interim the impact of the business associate provisions on covered entities be carefully evaluated.

Conclusion

The CLC supports the final rule establishing standards for the use and disclosure of protected health information. The revisions we have recommended are intended to protect the information in medical records and at the same time allow important research to proceed without unreasonable oversight. The final rule generally sets a strong federal standard, but enactment of legislation is necessary to address shortcomings in the rule.

The Cancer Leadership Council

Alliance for Lung Cancer Advocacy, Support, and Education
American Society for Therapeutic Radiology & Oncology, Inc.
Cancer Care, Inc.
Cancer Research Foundation of America
The Children's Cause, Inc.
Colorectal Cancer Network
Cure For Lymphoma Foundation
The Leukemia & Lymphoma Society
Multiple Myeloma Research Foundation
National Coalition for Cancer Survivorship
National Patient Advocate Foundation
National Prostate Cancer Coalition
North American Brain Tumor Coalition
Ovarian Cancer National Alliance
Pancreatic Cancer Action Network
The Susan G. Komen Breast Cancer Foundation
The Wellness Community
US TOO! International, Inc.
Y-ME National Breast Cancer Organization

Back to Privacy Index

About CLC  |  What's New  |  Policy Issues  |  Participants' Login
Home  |  Sitemap  |  Contact Info

Copyright © 2001-2002 Cancer Leadership Council. All rights reserved.
Please send comments and suggestions to webmaster@cancerleadership.org.