Deseret News (Salt Lake City), Aug 31, 2008 by Sue A. Blevins Christian Science Monitor
How would you feel about your personal health information flowing freely over the Internet between public health officials, health- care providers, insurance and data clearinghouse companies, and others — without your permission?
If this doesn’t sound like a good idea, it’s time to become informed about federal health-privacy law.
Today, when Americans visit a health-care provider for services (including dental and eye exams), they receive a form with a title such as “Notification of Privacy Rights.” Many assume that signing the form guarantees that personal information won’t be shared with third parties. But the form offers no such guarantees. And neither does federal law.
In fact, the privacy rule established under the Health Insurance Portability and Accountability Act of 1996 legally permits health- care providers to share patients’ information with more than 600,000 health- and data-related entities — without a patient’s consent. Yet the notification form doesn’t clearly explain this.
Individuals control their information when they give consent; they don’t with notification. When you sign a notification form, all you are doing is acknowledging its receipt. The HIPAA notification form offers no control over who sees your information and instead just tells you about some of the entities that can access your information, rather than asking for your permission.
Consequently, many physicians and other health-care providers are urging Congress to strengthen privacy rights. They know firsthand that the HIPAA rule fails to ensure true confidentiality.
“The regulations under HIPAA, which were intended to extend patient privacy as we moved from a paper-based system of medical records to a digital system, are a sham. HIPAA allows the routine release of personal health information without patient consent or knowledge and even over a patient’s objection,” stresses Dr. Janis G. Chester, president of the American Association of Practicing Psychiatrists.
As the ACLU put it, “HIPAA has so many medical privacy loopholes, it makes Swiss cheese look solid.” The organization also points out that under existing federal regulations, the term “privacy” hasn’t been well-defined. The ACLU is urging Congress to define medical privacy as “patient control of electronic medical records.”
Moreover, these organizations and others are lobbying for privacy amendments to key health Internet-technology bills currently being considered in Congress.
Lack of privacy has serious consequences