Clinton plan would tighten medical privacy

October 29, 1999
Web posted at: 10:36 a.m. EDT (1436 GMT)

In this story: President acted after Congress didn't Written consent required Penalties Patient notification required Teen rights RELATED STORIES, SITES

WASHINGTON (CNN) -- Because Congress "failed to act," President Clinton on Friday proposed federal regulations to keep some medical records away from curious employers, marketing firms and others who often see patients' most sensitive information without their consent.

MESSAGE BOARD Politics of health care     Highlights of Clinton's medical privacy proposal Limits the release of private health information without consent Covers only electronic medical records and computer printouts Allows patients to copy their medical records and request corrections Requires insurers to explain how patients' medical records are used Creates new penalties for the improper use or disclosure of information Won't be enforced until 2002

The proposed regulations would restrict the use and release of private health information transmitted or maintained by computers, including printouts.

"Every American has a right to know that his or her medical records are protected at all times from falling into wrong hands and yet more and more of our medical records are stored electronically," Clinton said at the White House. As a result, "the threats to our privacy have substantially increased."

"A recent survey showed that more than a third of all Fortune 500 companies check medical records before they hire of promote," the president said.

"One large employer in Pennsylvania had no trouble obtaining detailed information on the prescription drugs taken by its workers, easily discovering that one employee was HIV-positive," Clinton said. "This is wrong."

Health industry groups say it will cost billions of dollars to comply with the proposed measures and could hinder patients' access to their own records.

Congress debated the issue for years, but failed to meet a self-imposed August 21 deadline for legislating new protections.

Existing laws protecting medical privacy vary widely from state to state. Currently, there are no federal guarantees that private information won't be passed to employers, sold to pharmaceutical companies or talked about in insurance company offices.

The administration will publish the proposal next week for review. It has until February 2000 to issue a final proposal, with the rules to take effect in 2002.

The new federal rules would go beyond the weaker protections of some states, but would not override those with more restrictive laws.

Only congressional action can protect the large amount of medical information that has existed only on paper. "There are still protections ... we can give our families only if there is an act of Congress passed," Clinton said, asking House and Senate leaders to help enact "a comprehensive medical privacy law."

Under the proposal, doctors, hospitals or health plans would not release a patient's information for purposes unrelated to treatment and payment without written consent. Private information can now be released to financial institutions, direct marketing firms and others without a patient's knowledge or consent.

When required to release medical information, health organizations would have to limit the disclosure to the minimum necessary for each case instead of a patient's entire record. For example, when paying for medical services, no treatment information would be sent to banks or credit card companies.

The proposal would create new civil and criminal penalties for improperly disclosing patient information. Intentionally releasing information would be punishable by a fine of up to $50,000 and one year in jail. Someone trying to sell information could face a $250,000 fine and 10 years in prison.

Patients also would be given the right to see and copy their medical records and to request corrections of any errors.

Under the new rules, law enforcement organizations would be prohibited from obtaining medical records without legal authorization like a warrant or court order. This retreats from the administration's previous position of allowing law enforcement unfettered access to health records.

The plan would require health care providers to send patients a notice describing how they use electronic medical information and advise patients in advance of any changes.

Health maintenance organizations would also have to establish internal procedures to protect patient records, including limiting access to information and training employees to keep patient information private during their routine operations.

Regarding teen-agers who seek medical care on their own, the plan follows the lead of existing state laws. When a state allows a minor to obtain health care without notifying a parent or getting their consent, the minor's rights would be protected under the proposed plan.

If a state requires a parent to be involved, then the privacy rights would apply to the parent, not the minor.

During congressional debate, Democrats led by Massachusetts Sen. Edward Kennedy pushed to allow teens to keep their records private, even from their parents and even when it involves abortion.

After Congress failed to meet the August 21 deadline it set three years earlier, the 1996 law required the Department of Health and Human Services to write regulations on medical privacy.

White House Correspondents John King, Jonathan Karl and The Associated Press contributed to this report.