PRESS RELEASE
For Immediate Release
August 22, 2001
======================================
Citizens’ Council on Health Care
1954 University Ave. W., Suite 8
St. Paul, MN 55104
http://www.cchconline.org
=============================
CONTACT:
Twila Brase, R.N., President
651-646-8935p
=============================
FOR THE RECORD:
CCHC’s New Online Medical Privacy Forms
Helping
patients protect their medical, financial, and personal information
St. Paul, Minnesota—Asserting one’s
desire for medical privacy has just become easier than ever. Citizens’ Council
on Health Care (CCHC), a Minnesota-based independent health care policy
organization, has created and made available online three privacy declaration
forms for public use at: http://www.cchc-mn.org/fortherecord.php3
.
”The public is virtually clueless about the fact that several so-called medical
privacy regulations actually permit broad disclosures of medical information
without patient consent,” says Twila Brase, RN, president of CCHC.”Our project
was designed to give the public accurate information about their growing loss
of medical privacy and to provide them with tangible tools to express their
expectations for privacy.”
Brase adds, “These forms are meant to directly engage patients, doctors, and
institutions in a conversation about medical privacy and patient consent.”
”We have created a central place where people can obtain as many medical
privacy forms as they need from the convenience of their homes,” says Brase.
She notes that typical “opt-out” provisions, which allow sharing of data unless
individuals take specific steps to object, place a burden on the public. “They
may have to figure out who to call, where to get a form for each institution,
what form to sign, and where to send it. We’re providing one form for each of
three separate purposes, regardless of what corporation or institution is
involved.”
THE PROJECT
CCHC’s “For the Record” Medical Privacy Project 2001 gives patients and
members of the public online access to three 2-page medical privacy declaration
forms, one for each of three recent federal rules and laws dealing with access
to the medical, psychological, behavioral, financial and personal information
of patients:
FEDERAL MEDICAL PRIVACY RULE:
The rule, required by the 1996 Health Insurance Portability and Accountability
Act, went into effect on April 14, 2001. It requires health care
practitioners, facilities and insurers to provide the U.S. Department of Health
and Human Services (HHS) with access to patient medical records at any time on
any day to monitor compliance with the rule-without a search warrant or patient
consent. The rule also permits these entities, without patient consent,
to disclose individually-identifiable patient information to a wide array of
outside agencies and organizations, including government health databases,
public health agencies, law enforcement, researchers, organ donor organizations
and others who are not required by the rule to protect the privacy and
confidentiality of the information.
GRAMM-LEACH-BLILEY ACT:
Regulations and state laws promulgated to comply with the data privacy and use
section of the 1999 Financial Modernization Act allow health care data to be
disclosed and used without patient consent for 32 broad insurance functions and
research categories.
OASIS DATABASE:
The 1999 Medicare Condition of Participation rule requires that personal,
medical, behavioral, housing, relationship, education, and detailed physical
data be collected on most non-pregnant adults cared for in a Medicare-participating
home health agency-regardless of payment source.
The data, approximately 95 pieces of information collected at the first visit
and at intervals thereafter, is transmitted first to a state health agency
database and then sent electronically to the HHS where it resides permanently
in a national health care database called the Outcome and ASsessment
Information System (OASIS). For those who do not use Medicare or Medicaid
for payment, only four identifiers are masked: Name, Social Security Number,
Medicare number or Medicaid number. All other identifying information and
collected data is sent to the government databases. The data, often open to
subjective bias in reporting, is then available for ‘routine use’ and
disclosure to seven categories of groups and organizations.
After initially requiring no patient notification or consent, the U.S.
Department of Health and Human Services responded to privacy concerns by not
requiring the reporting of financial data (though it still must be collected)
and requiring patient notification but not patient consent.
DECLARATION SPECIFICS
The first page of each CCHC Medical Privacy Declaration Form includes an
explanation of the federal rule, the federal law that required the federal
rule, legal citations, a brief history, suggested recipients of the form, and
lists of data collected or permitted to be disclosed and used. The CCHC website
also provides additional information and Internet links to regulations, laws,
and related news articles.
The second page of each Declaration Form provides the user with blank spaces to
fill in the name of the intended recipient of the form, the name of the person
whose data is to be treated confidentially, a long check list of users, uses,
and recipients who the user does not want to receive the data, and space for
signature and other identifying information of the person using the form.
In a disclaimer at the bottom of the form, CCHC makes it clear that the
organization assumes no responsibility and will not be held liable if use of
the form does not protect the medical privacy interests of its users. However,
the form serves as a notice of intent, and a written protest if privacy is
violated.
Brase clarifies: “These forms are meant to pressure health care professionals,
the health care system and financial institutions to listen to their customers.
Federal laws are not on the side of privacy, so individual citizens must find
ways to protect themselves. “
FEELING THE HEAT
”You might say that these forms are a bit like a ‘Sunshine’ document. People
who present them will quickly learn about the privacy leanings of the people
whom they depend on for privacy protection. Wishy washy responses and
rationalizations may suddenly bring recipients of the forms under the gaze of
an angry patient or customer.” says Brase.
Congress and regulators could feel the heat as well. The CCHC website provides
a link to members of Congress and phone numbers of the regulators listed in
each published federal regulation.
PRIVACY AS A MARKETING TOOL
”We want privacy, and in particular medical privacy, to become a marketing tool
for doctors, hospitals, insurers, and financial institutions. Those who provide
it will have all the customers they need. Those who do not will be avoided. “Home
health agencies that don’t particpate in Medicare might get a lot more business
when people understand the intrusiveness of OASIS.” Brase says.
”We believe patients will choose whom they do business with according to who
respects their right to privacy. These forms will help citizens learn who will
protect their privacy and who will not,” she adds
The medical privacy rule specifically says that doctors, hospitals and health
plans do not have to comply with patient requests for confidentiality. However,
except for one required disclosure to the federal government and the OASIS
questionnaire, they can choose to honor the wishes of patients.
”We think institutions will find that most patients and account holders have no
desire to be the subjects of public health surveillance, fundraising and
marketing campaigns, unconsented research, databases, or fishing expeditions by
law enforcement,” opines Brase.
”We hope the pressure exerted by patients through these forms will help systems
and institutions choose confidentiality over disclosure. We also hope the
declarations will give health care professionals and institutions the support
they need to rebuff any and all efforts to access patient data without patient
consent.” she says.
NO CHOICE IN SOME CASES
Brase admits that the forms will not have any restrictive effect on required
disclosures of information. The federal medical privacy rule requires
disclosure to HHS for enforcement and monitoring purposes. In addition, the
OASIS collection is required by the federal government for home health agencies
that wish to be reimbursed under Medicare and Medicaid.
”It’s all about creating public pressure for change. We do not expect the
privacy declaration forms to solve entirely the growing problem of government
and corporate intrusion in the private lives of individual citizens through
their medical records. However, we aim to use the declaration forms to increase
public awareness and get the ball rolling in the right direction,” says Brase.
CONSTITUTIONAL CHALLENGES
She notes that the privacy rule is already the subject of litigation. The South
Carolina Medical Association has sued to limit federal power over the decisions
of health care professionals and the treatment of patient medical records. In
addition, a lawsuit by the Association of American Physicians and Surgeons to
address Fourth Amendment concerns has been announced, but not yet filed.
”The outcome of these constitutional challenges could be years away and are yet
unknown. In the meantime, we’re helping citizens and patients to help
themselves,” says Brase.
EASY ACCESS TO DECLARATIONS
To assure ease of access by the public, the CCHC website provides the Medical
Privacy Declaration Forms in both text and pdf format.
MORE FORMS TO COME
Brase says that these three forms do not represent the end of the organization’s
medical privacy project. CCHC expects to add several more forms to the website
before the end of the year. While the precise topics have not yet been
determined, Brase believes that disease-specific government databases may be
the next focus.
- 30 -
Citizens’ Council on Health Care is a non-profit 501©3 independent national
health care policy organization based in St. Paul, Minnesota.
*************************************************************
A citizens resource for designing the future of health care
*************************************************************
Citizens’ Council on Health Care
1954 University Ave.W., Suite 8
St. Paul, MN 55104
651-646-8935 phone
651-646-0100 fax
http://www.cchconline.org
**************************
NOTE: If you do not wish to receive this email,
contact CCHC to remove your name from the list.
Thank you.