August 20, 1999
On Medical-Privacy Issue,
By SHAILAGH MURRAY
Staff Reporter of THE WALL STREET JOURNAL
WASHINGTON -- Congress is starting to get serious about one of the most neglected items on its agenda: enacting the first national law to protect the privacy of medical records.
Didn't know there wasn't one? That is a leading reason the effort has sputtered for so long. Congress has been at the job for 20 years, and countless hearings, and at least 10 bills have come and gone since the mid-1990s. There was even a deadline -- Saturday -- which lawmakers obviously will miss.
That means it will fall to the Department of Health and Human Services, beginning in February, to regulate the disclosure of electronic medical records, a small portion of the total information pool. Almost everyone, HHS Secretary Donna Shalala included, prefers comprehensive legislation as the best way in the new Information Age to contain the possible abuse and misuse of what can be the most sensitive details of a person's life.
Who Knows What About Your Medical History? Insurance Companies If you've claimed it, they know it, from all laboratory tests you've taken to the number of times your kid has gotten stitches.
Big Government Requires medical records to verify claims made through Medicare, Medicaid, Social Security disability, workers compensation and state benefit programs.
Researchers Doctors, hospitals and other organizations often donate data for scientific purposes, but they're not supposed to release names. Medical Information Bureau Hundreds of insurance firms use this database of 15 million Americans and Canadians to obtain information about applicants for life-insurance and individual health-insurance policies.
Employers If they provide insurance, they can receive copies of your claims or medical records.
Direct Marketers Information can be used for marketing purposes
when you participate in informal health screenings, such as for cholesterol
or blood pressure at your local drug store.
Source: Privacy Rights Clearinghouse, San Diego
So the department will go forward, according to a spokeswoman,
but not so quickly as to pre-empt Congress if it takes action
this fall. That turns up the heat on Capitol Hill. In a 1996 law, Congress set a goal of Aug. 21, 1999, for enacting
medical-record privacy protections. Now, it calls the missed deadline a "tripwire," and support is galvanizing around a Senate
bill and two efforts in the House.
Medical privacy is difficult terrain for federal lawmakers. They
must navigate around a patchwork of popular state laws, many
of them targeted to specific conditions such as HIV and genetic disorders. They are also bumping against two perennial
controversies: abortion and liability (as in access to juvenile abortion records, and a patient's right to sue). And to cap it off,
political pressure to prompt them into action so far has been low.
Powerful consumer and health-care groups have called for national
protections, but they are fighting bigger battles such as
Internet privacy and managed-care reform. A single organization is solely devoted to the cause, the Health Privacy Project at
Georgetown University. And as director Janlori Goldman puts it, "How many doors can you bang on when you've got a couple
of staff people?"
Study of Fears
But the oddest feature may be the contrast between fears ordinary
Americans claim to have about medical privacy, and their
failure to communicate that to Washington. Ms. Goldman cites a recent study for the California HealthCare Foundation
showing just a third of U.S. adults trust health plans to maintain confidentiality. The study also found one of six people are so
worried about leaks that they lie or ask their doctors to lie, or go to different doctors, or don't seek treatment at all, especially
for sensitive conditions such as mental illness and communicable diseases.
Health Sites Are a Second Opinion, Not a Substitute for Doctor's Care (Aug. 17)
Should You Keep Files Stored on the Internet? (Aug. 16)
Yet medical privacy is not a hot-button political issue, and few
lawmakers hear from their constituents seeking protection for
their medical records. Apparently, that is because an overwhelming majority of Americans presume there is already a law on
the books to protect them.
"The lack of an outside force makes this a really difficult issue,"
says Joe Karpinski, spokesman for the Senate committee
working on a privacy bill for action this fall. "No one says, 'When are you to pass this?' No presidential candidates talk about it.
Even the professional groups haven't really gotten engaged."
On the other hand, he says, "Perhaps if there isn't a visible
political investment, it will be easier to work through delicate
issues like juvenile rights and produce a really good bill."
A promising sign for Ms. Goldman's camp is that despite the chaos
and foot-dragging, the bills to emerge in recent months
do adhere to a single framework. They grant that people should have access to their own records, that limits must be placed
on the use and disclosure of information, that police access should be restricted, and that violations should be penalized. In
the Senate in particular, several early obstacles have been overcome, including how often patients must sign waivers to
But big controversies do remain. These include access to juvenile
abortion records, whether patients will have the right to
sue, and how the federal law will mesh with existing state statutes.
A Breeze to Disseminate
Patients generally assume that their most embarrassing or devastating
health problems are safe in a color-coded file. But
the reality is, every note that doctors scribble or prescription they write may pass through dozens of hands and be typed into
multiple computer databases. With the dizzying advances in communications technology, medical information has become a
breeze to disseminate and hugely valuable to scientists, insurance companies, marketing concerns -- even employers and
It is one thing for researchers to cull genetic information to
cure breast cancer. But studies show that most people draw the
line when pharmacies sell prescription records to drug marketers, bosses peruse results of fertility treatments, or a hospital
accidentally posts thousands of patient records on the Internet. All three cases were reported recently, and privacy experts
say they are typical, except for one feature: Most abuses don't become publicly known.
"The problem is people don't realize when their privacy is being
violated," says Ari Schwartz, a policy analyst for the Center for
Democracy and Technology, a Washington civil-liberties group. "They feel strongly about the issue, but they won't speak up
until something happens to them. For most people it's a vague concern. That makes it difficult to galvanize them."
On Capitol Hill, the Senate health committee is believed to be
closest to producing a comprehensive bill with bipartisan
support. The effort is headed by Sen. Jim Jeffords, the Vermont Republican who chairs the committee, and Sen. Christopher
Dodd, a Connecticut Democrat. The two wild cards on the committee are Sen. Sam Brownback, an anti-abortion Kansas
Republican, and Democratic Sen. Ted Kennedy of Massachusetts, the committee's health-care activist whose support would
give the bill instant cachet.
In the House, two efforts have emerged as front-runners, one backed
by Rep. Bill Thomas (R., Calif.), who heads the Ways
and Means health subcommittee, and the other by a group of Democrats that includes Reps. Henry Waxman and Gary Condit
of California and John Dingell of Michigan. Mr. Thomas's staff has worked over the congressional recess to rally Democratic
support, so a bill can be introduced once Congress reconvenes after Labor Day.
Meanwhile, HHS is proceeding with regulations to cover electronic
records, which privacy advocates expect to function as a
de facto standard for printed ones. That is unless Congress gets its act together. Ms. Goldman and others, though, say they
will believe that when they see it. "There have been lots of bills and lots of hearings, where everyone pounds the podium and
says 'Yes, we're going to have legislation,' " she says. "And then nothing. It just goes away."