Public Hearing on Consent

Thank you, Mr. Chairman and Committee members, for holding this timely public hearing to examine how the new federal medical privacy rule affects patient consent and the principles of health care ethics. I appreciate the opportunity to testify and focus on the concerns raised by thousands of citizens who recently submitted comments to the U.S. Department of Health and Human Services (HHS) opposing access to their personal health information without their consent.

The NCVHS Subcommittee staff asked witnesses to address one (or more) of four questions submitted to panelists. Today, I would like to address the following question:

"How, if at all, does the privacy rule affect the principles of health care ethics applicable to patient consent?"

Consent

The federal medical privacy rule does not meet this definition of consent. Rather, it coerces individuals into sharing their personal health information. The rule codifies a new ethical code for medical care in the United States: individuals now may be denied medical treatment for failing to share personally identifiable information for purposes of "health care operations"—a broad term encompassing many uses.

Personal Autonomy

Confidentiality

Today, the sacred doctor-patient relationship is in jeopardy. The incredible technological advancements that brought us high-tech, life-saving medical treatments have also increased the risk of medical privacy invasions. Additionally, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) lays the groundwork for a national health information system. Personally identifiable health information about millions of Americans soon will be coded according to national uniform standards. Sensitive patient information will be compiled, stored and transferred electronically over the Internet. However, simply because we have new technology that facilitates the exchange of medical information electronically does not mean that we should eliminate the fundamental ethical concepts that have guided our physicians and nurses for years. Considering the forthcoming national health information system, we should be working toward strengthening—not weakening—the important ethical concepts of consent, personal autonomy and confidentiality. In fact, a majority of Americans strongly support informed consent when it comes to sharing their medical information.

National Gallup Survey on Medical Privacy

The national Gallup survey was conducted between August 11 and August 26, 2000 and the results are posted at the Institute for Health Freedom's Web site: www.ForHealthFreedom.org. The survey of 1,000 adults nationwide found an overwhelming majority of Americans do not want third parties to have access to their medical records—including genetic information—without their consent.

• 95 percent say banks should not be allowed to see patients' medical records without individuals' consent;
• 92 percent oppose allowing governmental agencies access to patients' medical records without permission;
• 88 percent oppose letting police or lawyers review medical records without explicit consent;
• 84 percent say employers should not be allowed access to patients' medical records without permission; and
• 67 percent oppose researchers accessing patients' medical records without consent.

The national Gallup survey also included two important questions about genetic privacy. One asked whether doctors should be allowed to test patients for genetic factors without their consent. Only 14 percent of respondents would permit such testing; 86 percent oppose it.

The other question asked whether medical and governmental researchers should be allowed to study individuals' genetic information without first obtaining their permission. More than nine in ten adults (93%) feel medical and governmental researchers should first obtain permission before studying their genetic information.

What's more, when asked whether they are aware of a federal proposal to assign a medical identification number— similar to a Social Security number—to each American, only 12 percent said they had heard anything about it. College- educated adults (16%) are more likely than those with less than a college education (8%) to be aware of the proposal. Regardless of their knowledge about it, however, an overwhelming majority (91%) oppose the plan.

Even so, the Health Insurance Portability and Accountability Act of 1996 laid the groundwork for assigning each and every citizen an "Unique Health Identifier," a patient ID number that could be used to track medical information from birth to death.⁶ That plan has been put on hold temporarily until strong medical privacy protections are established. The federal medical privacy rule will govern disclosures of individuals' medical records tracked by Unique Health Identifiers.

Does the Federal Medical Privacy Rule Infringe on Individuals' Freedom to Enter into Private Agreements with Doctors? Does the Rule Strengthen or Weaken Consent?

As you probably know, the federal medical privacy rule went into effect on April 14, 2001 and health care organizations have up to three years to comply with the rule. Once the rule is in full effect, Americans are going to be asked to sign consent forms to release their medical information for "treatment, payment and health care operations." Yet it is not clear whether citizens are going to be fully informed about how many third parties can have access to individuals' medical information for treatment, payment and health care operational purposes.

It is also important to note that under the rule, individuals are not guaranteed the right to restrict access to their records for treatment, payment or health care operations.⁷ As stated previously, health care providers and institutions may refuse to treat patients if they won't give consent to share their medical records for these three broadly defined purposes.⁸

At the same time, individuals will not receive an accounting of how many times their medical records were disclosed and to whom their records were disclosed for treatment, payment and health care operations.⁹ Rather, they will receive only an accounting of disclosures for purposes other than treatment, payment and health care operations. Given that these purposes are so broad, most citizens are not going to have a clue as to how often their medical information— including genetic information—is shared by third parties.

The public is being told that under the federal medical privacy rule they can demand greater privacy protections. However, they aren't being told that providers do not have to agree to patients' requests for stricter confidentiality. Moreover, even if a provider agrees to strict confidentiality, the rule says that such private agreements are preempted by section 164.512 of the federal medical privacy rule.¹⁰ This means that doctors cannot guarantee patients' strict confidentiality. Physicians are prohibited from entering into valid agreements with patients to keep their medical records private from many third parties, including (but not limited to):

• Federal and state officials monitoring oversight of the health care system
• FDA officials monitoring drugs, devices, and dietary supplements
• Foreign governments collaborating with U.S. public health officials
• Researchers conducting genetic research (if an IRB or privacy board waives patient consent)
• Law enforcement agents
• Judicial and administrative officials
• Licensure and disciplinary officials.¹¹

Why should citizens be concerned about the rule's impact on their ability to control access to their medical information? Because once individuals' medical records are disclosed to a third party (other than a business associate), the final rule no longer protects that information. The rule specifically reads:

". . .[O]nce protected health information leaves a covered entity the Department [HHS] no longer has jurisdiction under the statute to apply protections to the information."¹²

Also, there is nothing in the rule that prohibits the federal government, state governments or private parties from compiling large databases of patient information, for the purposes listed above, without patients' consent. The rule does not apply to information that is collected or stored in databases without consent prior to April 2003 (when most providers are required to comply with the rule). It states:

"We do not require covered entities with existing records or databases to destroy or remove the protected health information for which they do not have valid consents or authorizations. . ."¹³

What's more, the final rule does not cover the procurement or banking of blood, sperm, or body tissue. In fact, the final rule states:

". . .[T]he procurement or banking of organs, blood (including autologous blood), sperm, eyes or any other tissue or human product is not considered to be health care under this rule and the organizations that perform such activities would not be considered health care providers when conducting these functions."¹⁴

Because blood, sperm and body tissue includes genetic information, lack of privacy protections in these areas could have far-reaching effects for millions of Americans.

Recommendation

Finally, you asked for practical solutions to the current privacy rule debate. I offer the following recommendation to help ensure that America's high ethical health care standards are maintained:

It should be up to individuals—not the federal government—to decide to whom they want to disclose personal information. Individuals and their doctors (and other providers) should be free to enter into private agreements regarding disclosure of individuals' medical information— including genetic information.

Clearly, an individual's rights end when he or she becomes a threat to society. But until that burden of proof has been made clear, we must continue to uphold individuals' rights and the important health care ethics of consent, personal autonomy and confidentiality.

Conclusion