Privacy Rights Are Ended in America in 2002

Posted by permission. Copyright by MCMHPC. Originally posted at http://www.thenationalcoalition.org/PrivacyDB.htm

Compare these two facts:
 Fact: The Bush Administration’s “Rule Changes” (Health and Human Services Department) in August 2002, ended the right (previously stipulated in HIPAA privacy regulation) of each American to consent to the release of personal health information, and gave “regulatory permission” for disclosure of any identifiable health information for treatment, payment, and healthcare operations (TPO), stipulating that the treating professional should determine the minimum necessary information to be disclosed to meet TPO requirements, and that the patient must be advised of that professional’s privacy policies.

Fact: The U. S. Supreme Court (Jaffee v. Redmond, 1996) recognized the need for absolute privacy in psychotherapy, saying, “the mere possibility of disclosure of confidential communications may impede the development of the relationship necessary for successful treatment.”

Privacy – maintaining control of one’s personal information, is crucial. If patients are to provide the highly personal information required for quality health care and mental health treatment, trust in the confidentiality of that treatment is essential.

Without the guarantee of privacy, people will avoid needed care, and will withhold necessary information, particularly in mental health where personal information can include symptoms, behaviors, thoughts and feelings that are embarrassing, shaming or socially considered inappropriate. Jobs, loan applications, insurability and many critical life economic needs are threatened.

The privacy of medical and mental health information is eliminated by: changes in how records are kept by hospital and clinics, group practices, by requirements for reporting child and elder abuse and dangerousness to self and others, by agencies monitoring care that is financed by public payers, by demands by private insurers and managed care companies that detailed patient records must be reviewed for payment authorization to be granted, and by records being kept on widely accessible computer systems, and by the millions of billing and prescription and treatment records transmitted over the Internet.

Key Elements Needed to Protect Medical Information Privacy:

Consent:

• People must have the right to Consent to any disclosure of their private information, and must be fully informed each and every time of the purposes of that Consent.
• When there is Consent, disclosure should be only for treatment and payment, not for health care operations or any other purposes.
• Authorization should be required for any disclosure beyond treatment and payment.
• Disclosure of information should be limited to only the minimum amount necessary to accomplish the purpose of the disclosure, as determined by the health care provider.
• Individuals should be permitted to keep private any personal or medical information not necessary for payment purposes and designate the person(s) or entity to which it might be disclosed.

Disclosures for Oversight/Public Health/Research:

• Only non-identifiable medical information should be available for oversight, public health, and research efforts.
• Personally identifiable data should be disclosed only if required by law or when voluntary informed consent is given.

Law Enforcement:

• Standards for disclosure without patient consent should be very high.
• At a minimum law-enforcement should show that there is probable cause that a crime has been committed and there is no other way to obtain the information.

Federal privacy regulation, under the Health Insurance Information and Portability Act (HIPAA), provides a floor, not a ceiling for state privacy laws. Strengthening state laws may now be the best privacy protection strategy. HIPAA regulations deny some of the basic privacy protections outlined above.