The Leading Business Education Network for Doctors, Financial Advisors and Health Industry Consultants

Grading Texas Lawmakers on Patient Privacy

2 Responses

1. D. Kellus Pruit DDS, on December 13, 2010 at 5:59 PM said:

   Addressing encryption

   HIPAA says encryption of PHI is “addressable.” So let’s address it.

   I posted the following challenge on 8 of my elected officials’ Websites.

   ——————

   Honorable

   In an email this weekend, I sent you and 7 other of my elected officials a copy of a “report card” reflecting my opinion of your representation of my Fort Worth dental patients’ interests concerning HITECH/HIPAA and patient privacy.

   The following 7 representatives on state and national levels failed to respond meaningfully, including 5 who failed to respond at all: US Senators John Cornyn and Kay Bailey Hutchison, US Representative Joe Barton, Texas State Senators Wendy Davis and Chris Harris, and Texas State Representatives Diane Patrick and Marc Veasey. Naturally, all 7 received failing grades from me.

   Only US Representative Dr. Michael Burgess passed, and with A+ honors.

   “Grading Texas Lawmakers on Patient Privacy” was picked up this morning by the Medical Executive-Post, which has over 250,000 readers. This one looks like it could become popular.

   Grading Texas Lawmakers on Patient Privacy

   Dr. Burgess’ thoughtful and personalized response is copied in the article. I’m grateful for him. Since identity theft from healthcare facilities is becoming worse instead of better, dental patients need more representatives like Michael C. Burgess MD in Washington. His confidence in his knowledge of healthcare issues allows him to discuss topics concerning eHRs in dentistry that even my ADA representatives have transparently evaded for years. That’s progress in the land of the free.

   Even though the ADA strongly advises members to encrypt Protected Health Information (PHI), it is simply not happening in dentistry, and I doubt if it is widespread in physicians’ offices either. Otherwise, encryption would be a hot topic in HIT literature – and encryption is simply not being discussed anywhere as far as I can tell. In fact, Dentrix, the largest selling dental software in the nation, refused to reply to basic questions about encryption on their Facebook page last week. I think you can see that this is a volatile topic that needs attention now, while it is still way under the radar, rather than later when the failure becomes exponentially more costly to Americans.

   Consider what a Wikileaks spin-off could do with almost all US citizens’ health histories – including DNA information. The liabilities of fumbled identities only last lifetimes. DNA codes last generations.

   We must get a handle on slippery eHRs – even in dentists’ offices.

   Sincerely,

   D. Kellus Pruitt DDS

   LikeLike
2. Jim Pyles, on October 1, 2014 at 9:55 AM said:

   On the right of patients to request restriction of shared health information

   The patient’s right to not have health information shared without consent was the standard practice throughout the history of the country and most of the history of medicine ( at least since the Hippocratic Oath in the 5th Century B.C.), as recognized in the Original Privacy Rule issued by the Clinton Administration. Then the Bush Administration, after confirming the Original Rule, reversed its own decision in the amended HIPAA Privacy Rule in August of 2002.

   [See Clinton Administration findings at 65 Fed. Reg. at 82,472 (Dec. 28, 2000)]

   HHS under the Bush Administration addressed the obvious inconsistency with prevailing standards of professional ethics and the concern that disclosures without consent would become the “de facto” practice by stating that the HIPAA Privacy Rule was only intended to be a “floor” of federal privacy protections and was not even intended to be a “best practices” standard. They stated further that state laws and professional standards that are more privacy protective “retain their vitality”.

   [See 67 Fed. Reg. at 53,212 (Aug. 14, 2002)]

   So now the HIPAA Privacy Rule provides federal “regulatory permission” (HHS’ words, see 67 Fed. Reg. at 53,211) for covered entities to use and disclose anyone’s identifiable health information for TPO without consent and even against the individual’s wishes, but standards of professional ethics of the AMA and most other professional organizations prohibit such unauthorized uses and disclosures. The HITECH Act merely reinstated the right of consent for the use and disclosure of health information to health plans for payment and health care operations if the individual pays out or pocket (which commonly occurs with mental health care—especially in Washington, D.C. where the laws are made).

   So today, HHS authorizes the disclosure of anyone’s health information regardless of their wishes for TPO in violation of traditional standards of medical ethics. But those who can afford to pay for health care services can have their right to privacy restored in a limited way, if they ask for it. This leaves us with the question—why should the right to health information privacy be available only to those who can afford to pay for care?

   Some have objected that heeding the patient’s wishes to not disclose health information when the patient pays out of pocket would be too difficult for current HIT systems to accommodate. That argument has caused some others to suggest that we should consider constructing a health IT system that is consistent with patient wishes and professional ethics rather than trying to modify patient wishes and professional ethics to fit the limited capabilities of the current HI technology.

   Also, HHS pointed out in its response to those who said that accommodating patients’ wishes was too difficult that the Privacy Rule already requires covered entities to be able to limit the disclosure of certain information in order to comply with the minimum necessary rule which requires that standard to be applied in a manner that is “consistent with and not override professional judgment and standards”.

   [See 78 Fed. Reg. at 5628 (Jan. 25, 2013) and 67 Fed. Reg. at 53,197]

   The “too difficult” argument assumes that the HIT systems being developed for use by practitioners are routinely violating HIPAA and the practitioners’ professional ethics. See 78 Fed. Reg. 5628-5630 for some discussion of how the right to pay privately can be implemented.

   So we now have a HIPAA Privacy Rule which authorized many covered entities to use and disclose patient information in a way that is contrary to patient wishes and practitioners’ standards of ethics. And a HITECH Act that restores the patient’s right to privacy, but only if they can afford to pay for it. This has resulted in eroding public trust that the health care system will protect the right to privacy (that and the near daily headlines of massive privacy breaches possible only with HIT systems) and confusion among practitioners about precisely what is required of them.

   This is what you get when you use a “stakeholder” approach to health regulation. The patients, who have the most “at stake” and without whom there can be no health care delivery system, are always outvoted by the other stakeholders whose principal interest is “efficiency”. The HIPAA Privacy desperately needs to be revised from the ground up taking the approach we commonly take in the practice of medicine—we put the ethical practice of medicine, and the patients, first and craft rules to protect them.

   That should be still possible if you believe that the HIPAA Privacy Rule is only a federal “floor”.

   Jim Pyles
   [James C. Pyles, Principal]
   POWERS PYLES SUTTER & VERVILLE PC
   1501 M Street NW, Seventh Floor | Washington, DC 20005-1700

   via Darrell K. Pruitt DDS

   LikeLike