March 26, 2001
U.S. Department of Health and Human Services
Dear Secretary Thompson:
We submit these comments regarding the final federal medical privacy rule (Standards for Privacy of Individually Identifiable Health Information), 45 C.F.R. Parts 160 through 164.
In a nutshell, we object to the way the rule gives greater rights of access to the government than to the patient himself.
Our specific objections are as follows:
Section 160.203: We object to the preemption of state laws providing greater rights of access to individuals to their own medical information. The regulation should expressly establish, without ambiguity, that state laws providing greater rights of access by individuals to their own medical information are not preempted.
Section 160.203(c): We object that weaker state privacy laws are not preempted if "[t]he provision of State law, including State procedures established under such law, as applicable, provides for ... the conduct of public health surveillance, investigation, or intervention" in addition to "disease or injury, child abuse, birth, or death." There is no justification for permitting public health surveillance and dissemination of personal medical records, without consent, for categories other than those listed. This "public health surveillance, investigation, or intervention" exception is unlimited and should be revised to prohibit state compilation and dissemination of personal medical records without prior written patient consent. We do agree that stronger state privacy laws concerning medical records should not be preempted by federal regulation.
Section 160.310(c): We object to the U.S. Department of Health and Human Services or any other government agency accessing personal medical information without prior written patient consent by the patient or a valid warrant. If there is compelling need for government access to personal medical information, then a warrant can and should be obtained. If there is not a compelling need, then prior written patient consent is necessary. Under subpart (c)(3), the Secretary should not be allowed to disseminate information so obtained merely as "otherwise required by law," which would allow any other law (even future FOIA amendments) to preempt privacy. To the contrary, the Secretary should be prohibited from disclosing personal medical information without patient consent, any other law notwithstanding.
Sections 164.502: We object that patient's records can be disclosed without his written consent for all the following purposes: public health, research, law enforcement, oversight of health care, judicial and administrative proceedings, treatment, payment, or health care operations. Moreover, patient consent should be voluntary, such that patients should not be forced to forgo medical treatment in exchange for obtaining privacy.
Sections 164.506 and 164.508: We object to allowing health plans to condition enrollment in a plan or eligibility for benefits on the patient's consent or authorization for disclosure.
Section 164.512: We strongly object to third parties having access to personal medical information (including genetic information) without prior written patient consent, which is freely given and not required as a condition of the provision of medical care.
Section 164.514: We object to allowing direct marketers access to personal medical records for marketing purposes. We object to pharmacies being permitted to share patients' prescription records with "business associates" for the purpose of marketing "health-related products and services of the covered entity or of a third party." Prior written, informed patient consent should be required.
Section 164.520: We agree that patients should have the right to inspect, copy, amend, and receive an accounting of disclosures.
Section 164.522: We object to allowing a covered entity to deny care if a patient asks for a restriction on disclosure with which the health plan disagrees.
Section 164.524(a)(2)(iii): We object to preventing patient access to his own medical records during research, regardless of whether the patient consented to such denial. Medical conditions often change for patients, and patients retain an unwaivable, constitutional right to their own medical information. There is no justification for withholding such information.
Section 164.524(b)(2): We object to the 30-day response time for responding to a patient's request for his own medical information. Medical problems require much quicker response, and the delay allows providers to prevent patients from going to competitors. The provider should be required to provide the information in no more than 10 days, rather than merely "act" on a request within up to 30 days.
Section 164.528(a)(2): We object to the power to suspend the patient's right to an accounting of disclosures if a law enforcement or health oversight agency gives a written statement that the disclosure would "likely impede the agency's activities."
Finally, we request that HHS extend the public comment period to 180 days, in order to allow adequate time for comment by all who are affected by the new rule.
Please feel free to post our comments.
Andrew Schlafly, Esq.