Health and Human Services Secretary Donna Shalala introduced a proposal Thursday for handling the privacy of medical records in the digital age, saying that her approach strives for a "balance of interests" despite the fact it leaves law enforcement with a free hand to look through personal medical records.
"We are not recommending any changes to existing laws to give law enforcement more access," Shalala told members of the Senate Labor and Human Resources Committee. "What we are recommending is criminal and civil penalties for violations of confidentiality."
Shalala's 81-page report recommends ways to protect privacy of personal health information and to establish penalties for the wrongful disclosure of such information. Among the recommendations are that patients could see their records and propose corrections; hospitals, doctors, and insurance companies would be liable for ensuring the privacy of those documents; state laws stricter than federal law would remain in force; and patient could sue if they felt their privacy had been violated. The report was required by the Health Insurance Portability and Accountability Act of 1996.
The issue of medical records privacy has heated up in Congress in recent years because of the change in how medical records are stored - information once kept in a doctor's office filing cabinet is now an infoblip on huge hospital databases potentially accessible to many people.
Although the administration's plan says that disclosures without patient consent should only be allowed in special cases, and that law enforcement sometimes needs access to medical records, critics say this does not go far enough in protecting privacy.
"There are no limits proposed in the way in which law enforcement agencies can use or redisclose health records," Senator Patrick Leahy (D-Vermont), who plans to introduce a medical records privacy bill later this month, said in a statement. "Taken to an extreme, this could mean disclosure to the press or any individual without any recourse."
Donald Haines, legislative counsel for the ACLU, said that "with these regulations, [Shalala] is slipping a key to any government agency, law enforcement officer, or private organization who wants a look at what's inside."
But Shalala said that, in fact, criminal and civil penalties in her proposal offer a deterrent to unlawful release of medical records to third parties.
"We are not without laws in this area," she said.
But in answering a hypothetical question posed by Senator Bill Frist (R-Tennessee), Shalala made clear that information under inspection for one purpose could easily wind up in the hands of the police.
Frist asked what would happen if an inspector general looking through medical records for evidence of fraud came across records revealing illegal drug use. Could the official use that incidental information to launch an investigation? Shalala said it was possible the information could be used that way.
"If in the course of an investigation, the person finds criminal activity, unless it's very clear, he will not act on it, but he may pass it on to other law enforcement agencies like the FBI," she said.
Frist responded that in the ongoing debate on medical privacy, "law enforcement clauses would have to be discussed."
