Critics Decry Exemptions Won Through Lobbying
By Robert O'Harrow
Washington Post Staff Writer
Tuesday, January 16, 2001; Page E01
New federal medical privacy regulations, touted by the Clinton administration as a landmark of patient protection, will for the first time explicitly permit doctors, hospitals, other health services and some of their business associates to use personal health records for marketing and fundraising.
The rules were included in the federal regulations after a months-long public relations effort by the industry. Under the exemptions, doctors, clinics, hospitals and others that normally have access to medical records -- along with business associates working under contract with them -- will be allowed to send out individualized health information and product promotions.
A pregnant woman, for instance, could receive pitches about vitamins or infant health-care products. A patient who has been treated for sexually transmitted diseases could receive telemarketing calls offering condoms or new medicines.
The exemptions also give foundations affiliated with hospitals continued access to patient names, ages, addresses and telephone numbers for fundraising initiatives. Such foundations raise billions of dollars annually by soliciting patients and their families at medical facilities and at their homes.
Officials of the Department of Health and Human Services, the White House and some patient advocates said the new privacy regulations announced Dec. 20 stand as an important new bulwark against the misuse of patient information, notwithstanding the exemptions.
When the rules fully take effect in two years, proponents said, patients will have a new right to access their own records; employers will be prohibited from receiving personal health data, except for the administration of health plans; and people who misuse private medical records, such as selling them, could face fines or prison.
In addition, any health-care provider or service that uses medical records will have to notify patients how they're doing so. Patients also will have the option of saying no to marketing or fundraising -- but only after they have been contacted at least once by a given entity.
Gary Claxton, deputy assistant secretary for health policy at HHS, said the department deftly handled the complex task of protecting medical records while encouraging the flow of information to improve patient care.
"It's the best we could do and we think we did a good job," he said. "There's going to be a lot of discussion as this is implemented. If changes need to be made, they should be made."
But consumer advocates and privacy specialists worry the exemptions will undermine the spirit of the rules and spur the use of confidential records for marketing by specifically allowing activity that in the past was often constrained by ethical or business concerns.
Among other things, the regulations will permit pharmacies to share patients' prescription records with business associates to target patients with letters reminding them to take medicine, or to send them "educational materials" sponsored by drugmakers.
That sort of arrangement created a storm of controversy three years ago when it became public that CVS Corp., Giant Food Inc. and other pharmacies shared prescription information with a data-management company called Elensys for targeted mailings. CVS and Giant canceled the programs after customers complained.
The new marketing and fundraising rules have "exploded the old notions of medical confidentiality and privacy," said Thomas Murray, a medical ethicist.
"Your medical record was meant for your medical care," said Murray, president of the Hastings Center, a medical ethics research center in New York. "Now your medical record becomes a marketing tool."
Supporters of the new rules note that health-care providers now will have to determine that products provide a health benefit before making a contact with a patient. When contacting a patient, marketers and fundraisers will have to disclose the source of personal information, describe their financial benefit and explain why the individual was targeted for a promotion, officials said.
Critics say that while patients will be allowed to say no to promotions after being contacted, they will have to reach out to each entity that has contacted them to exercise that right.
"The rules are filled with virtual rights: You reach for them and they're often not there," said Robert Gellman, a lawyer and privacy consultant in the District, who has studied the regulations. "This authorizes a kind of behavior that was once viewed as unethical or improper."
Claxton, the HHS official, said officials faced the challenge of distinguishing between educational material about products and services that improve health, and marketing promotions sponsored by drug companies and others.
Because the department concluded that getting health information to patients was so important, officials decided to be more flexible on the issue of marketing than the draft released in 1999, as long as health-care providers meet guidelines for disclosure and give patients the ability to opt out, among other things.
"What is communication for health care, and what is marketing? Sometimes they're the same thing," Claxton said, adding that department officials believe that doctors, hospitals and others still will be constrained from doing anything that might offend patients.
Claxton said industry pressure played no role in the decision to include exemptions for marketing and fundraising. He said he maintained contact with some key groups that supported the changes as part of the normal regulatory process. Those groups included the American Hospital Association, the Association for Healthcare Philanthropy, pharmacy benefit managers, insurers and consumers.
The company that worked with CVS and Giant, now known as Adheris, urged regulators in comments on the draft proposal not to require pharmacies to get "prior authorization" from patients to use prescription information for targeted mailings.
Industry leaders acknowledged pressing for changes to the draft regulation, which would have proscribed many fundraising and marketing initiatives allowed under the final rules. Among the most aggressive groups was the Association for Healthcare Philanthropy. Its members raised nearly $6 billion in fiscal 1998 for construction projects, to buy equipment, run programs and so on.
The group wrote letters to HHS, met several times with regulators and as recently as December participated in conference calls with them to clarify issues. They turned to Rep. Ellen Tauscher (D-Calif.), among others on Capitol Hill, saying a staffer called HHS officials on their behalf.
The association became so aggressive about the issue that department officials told it to tone things down, according to officials in the department and the group. "We stopped doing that because HHS said, 'Hey, we got it. We got your message,' " said William C. McGinly, the association's president and chief executive.
In the end, they got what they wanted -- access to patient information without having to get permission from patients first. "AHP Announces VICTORY! Patient Privacy Regs Favorable to Health Care Philanthropy," said the group's press release.
"By pulling together a public relations specialist, a lobbying expert, writers and others to analyze the draft regs, comment, communicate to the press, meet and educate the staff and members of key Congressional committees and others, we were able to see that AHP was heard on this issue," the press release said.
The provisions don't sit well with critics, who contend that patients ought to have a right to say no upfront to uses of their medical records that do not have a direct bearing on health care. Some critics also may be urging states to write tougher rules of their own.
"Once they have open
access, where else does it go? It is too big a loophole," said Sen. Patrick
J. Leahy (D-Vt.), who may pursue legislation on the matter. "In the digital
age, any loophole is bigger than it looks."
© 2001 The Washington