Bush Administration Calls for
Public Input on Final Medical Privacy Rule

Washington, D.C.—On March 27, 2002, the U.S. Department of Health and Human Services (HHS) announced a call for public comments regarding its plans to revise the federal medical privacy rule. The final federal medical privacy rule was promulgated by the Clinton Administration and published in the Federal Register on December 28, 2000. Since that time, HHS and the federal National Committee on Vital and Health Statistics (NCVHS) have been consulting with health care industry leaders to modify Americans' rights to medical privacy. In particular, they want to eliminate the current standard whereby patients give their written consent before their personal health information—including genetic information—is shared with others.

"Citizens who are concerned about their rights to medical privacy should let HHS know how they feel about this important and timely issue," says Sue Blevins, president of the Institute for Health Freedom. "In a few years, patients' personally identifiable health information is going to be flowing over the Internet. But patients won't even know this is happening because they won't be able to obtain an accounting of when and to whom their health information was disclosed for most of their health care services. Americans should let HHS know how they feel about this issue."

Here are some questions to consider regarding the final medical privacy rule:

• Should health insurers, doctors, and medical data-processing companies have to get your written, informed consent before sharing your personal health information-including genetic information-with others?
• Should the federal government's Secretary of Health and Human Services and/or Office for Civil Rights be permitted to access your medical records without your permission?
• Which third parties, if any, should have access to your personal health information-including genetic information-without your written, informed consent? (Consider the following: Banks, law enforcement, researchers, insurance companies, employers, public health officials, FDA, and the Secretary of HHS.)

• When submitting your comments, HHS says you must cite specific sections of the rule and then give specific comments (see the following sample). If you don't cite specific sections of the rule, HHS might not consider your comments.
• Given the recent slowed mail system, if possible you should send your comments by certified mail. Your comments must be postmarked by April 26, 2002.
• Do NOT send a fax or call HHS. Unfortunately, HHS says it is not accepting comments by fax or phone. In fact, HHS says it will destroy such submissions.
• For information, contact Felicia Farmer at HHS at 1-866-627-7748.
• Mail your comments to: U.S. Department of Health and Human Services, Office for Civil Rights, Attention: Privacy 2, Hubert H. Humphrey Building, Room 425A, 200 Independence Ave., SW, Washington, DC 20201.
• HHS says all comments should include the following information: full name, address and telephone number of the sender or a knowledgeable point of contact.
• Although mailing comments is preferred, you can submit your comments at the following Website: http://www.hhs.gov/ocr/hipaa/
• Following is a valid sample response citing specific sections of the final federal medical privacy rule.

SAMPLE COMMENT LETTER

Jane Doe
123 Main Street
Freedom City, VA 00000

April 16, 2002

U.S. Department of Health and Human Services
Office for Civil Rights
Attention: Privacy 2
Hubert H. Humphrey Building, Room 425A
200 Independence Ave., S.W.
Washington, DC 20201

Dear Secretary Thompson:

I am writing to share my comments regarding your plans (as announced March 27, 2002) to modify the federal medical privacy rule (Standards for Privacy of Individually Identifiable Health Information). Following are my specific comments on specific sections of the rule:

Sections 164.502 and 164.506: I want to be the one who decides whether and which health insurers, doctors, and medical data-processing companies can have access to my personal health information-including my genetic information-for all purposes, including treatment, payment and health care operations. The Department of Health and Human Services should not be making this decision for me.

Additionally, I want to maintain the right to enter into private agreements with doctors and other health care providers to maintain the confidentiality of personal health information. These sections of the rule need to make it clear that the federal medical privacy rule will not interfere with my right to contract.

Section 164.512: I strongly object to third parties having access to my personal health information-including genetic information-without my written, informed consent.

Sincerely,

Jane Doe