WPF responds to HHS and urges it to keep privacy protections in HIPAA strong
WPF has written to the US Department of Health and Human Services advising them on their Request for Information (RFI) about possible changes to HIPAA privacy and security protections. The RFI has a number of suggestions that, should they become part of a formal proposal, would significantly weaken HIPAA privacy protections.
Of the proposals in the RFI that impact privacy, we are the most concerned about HHS’s possible change regarding making disclosure of health records mandatory for treatment, and possibly also mandatory for healthcare operations. A requirement for mandatory disclosure of patient health records — even for treatment purposes — would significantly weaken privacy protections. In our comments, we explain why.
Currently, the HIPAA rule is permissive, not mandatory. A provider today can say to a patient, with a straight face for the most part, that the provider will not disclose that patient’s record without legal compulsion. But no reassurance to a patient that the patient’s record will be held to the highest possible level of confidentiality will be available if any treating physician anywhere in the country (or in the world) could demand disclosure for treatment of another patient.
We observe that even the existing rule allows for a middle ground. It allows treating physicians to consult with each other without any exchange of identifying information about any patient. There is no need to go beyond the existing compromise.
Compelled, mandatory disclosures for treatment will open the door to conflicts that cannot be resolved by other means. There will be no middle ground available. One provider will simply demand production of a patient record, and the other provider will have no choice. There needs to be some give in the system to cover hard cases, and the current rule is adequate for that purpose.
The only exception to consider is that if the disclosure of a patient’s records is for the treatment of that same patient, then compulsion may be appropriate with the written consent of the patient. There is no need to balance interests when only one patient is involved, and especially when that patient consents to the disclosure.
We have urged HHS to not weaken the provisions of HIPAA and to leave HIPAA disclosures as they are now — permissive, not mandatory. To read about this issue in more detail, and other privacy implications of the RFI, see our complete comments here.