One Final Hope for Saving Medical Privacy

One Final Hope for Saving Medical Privacy

Charlotte Twight
Saturday, Aug. 10, 2002

Editor’s note: This is the conclusion of an article on how federal regulations that purportedly protect medical privacy have in fact done the opposite. Part one: Regulations Destroy Privacy. Part two: Rules Advance a National ID. Part three: Media and Feds Whitewash Invasive Rules. Part four: 'Privacy' Rules Spread Your Personal Medical Information. Part five: How Big Brother Foists Invasive Regulations on the Public.

The outlook for medical privacy is bleak. When the Bush administration allowed the medical privacy rule to take effect, privacy advocates expressed hope that the rule’s fundamental problems might be remedied by future modifications of offending provisions, but such melioration now appears unlikely.

Although some revisions are to be expected, it is highly doubtful that the basic structure of the regulation will change — at least not at the government’s own initiative.

If this view seems too pessimistic, consider the issue from the perspective of a congressional representative or senator. Envision a roll-call vote on these "standards for privacy of individually identifiable health information.” Even knowing all that we know about the HHS rule, would most legislators choose to go on record opposing the measure, in hopes that they could somehow explain to their constituents why they voted to dismantle the "medical privacy rule”?

That choice is the very one legislators would have faced if Rep. Ron Paul, R-Texas, had succeeded in June 2001, under Congressional Review Act procedures, in bringing to a vote his proposal to repeal the rule (H.J. Res. 38).

Big-Government Interest Groups vs. the Public

Clearly, with adoption of the HHS medical privacy rule, political transaction costs have been shifted again. Strong political forces would be needed to change the new status quo in a fundamental way, but such opposition is unlikely to materialize:

in part because this regulatory package has been falsely represented to the public as enhancing privacy,

in part because of the usual realities of concentrated interest groups arrayed against dispersed citizens who, even if they understood the anti-privacy nature of the regulation, would have scant incentives as individuals to undertake costly political action.

Obviously, the interest groups that expect to benefit from the government-mandated cornucopia of individually identifiable medical information will not readily relinquish their prize.

Blackmail

Political transaction costs of resisting this rule and other government-expanding measures will also change on a deeper level as a result of the privacy-destroying features of the new regulation. With government officials and others gaining greater access to personal medical histories under the rule, it will become increasingly possible for recipients of that information illicitly to threaten political and ideological adversaries with public revelation of embarrassing or damaging material gleaned from those records.

The long history of both Democratic and Republican administrations’ official misuse of FBI and IRS records attests to this danger. As Richard Sobel of Harvard Law School has stated, "centralized information is centralized power” (quoted in Stolberg 1998, A13). With implementation of the HHS rule, centralized medical information will create more such power, increasing the political transaction costs of dissent on a broad range of public-policy issues.

If my analysis is correct, the rule’s key provisions undermining medical privacy are likely to remain intact as diverse interest groups vie for modifications of the regulations.

The language of consent will continue to be coupled with the reality of coercion. Laudable purposes such as law enforcement, domestic abuse prevention, efficient government administration, and the like will continue to mask the rule’s overbroad exceptions to requirements for patient consent, enabling government entities to remain as the principal beneficiaries of the disclosures.

The sharing of personal medical data among government agencies, already a reality, will not be forsworn. With regard to non-covered entities’ redisclosure of medical records, as HHS has stated, the authority for extending privacy regulations to these recipients would require extensive new legislation, which is unlikely to be passed any time soon — and, as a practical matter, also unlikely to be enforceable even if enacted into law.

One Hope

The chief — perhaps the only — hope on the immediate horizon is a lawsuit filed on July 16, 2001, challenging the HHS medical privacy rule on constitutional grounds. In a lawsuit against HHS and HHS secretary Tommy Thompson, plaintiffs in the case (physicians and medical societies in Louisiana and South Carolina) raise constitutional challenges to the HHS privacy regulation and to the HIPAA provisions authorizing it (Civil Docket No. 3:01-CB-2965, U.S. Dist. Ct., District of South Carolina Columbia Div., cited in Brase 2001). The outcome of that suit should be watched closely.

In the meantime, with the reshaping of political transaction costs surrounding the new federal health information system, the impending destruction of medical privacy becomes an ever more likely institutional reality. On July 6, 2001, HHS released more than 35 single-spaced pages of official "guidance” regarding implementation of the medical privacy rule, still denying that the rule expands government and law enforcement access to our medical records, except with regard to enforcement-related HHS access (U.S. Dept. of HHS OCR 2001, HIPAA Privacy TA 160.300.001).

HHS protestations notwithstanding, as I have shown, the medical privacy rule does ensure that Americans will be subjected to ever-increasing government access to their medical records without their consent, as well as to similar access by private companies acting with the blessing of the federal government. The only question is how soon this new mother lode of personal medical data will be fully exploited for private political and economic gain.

Never mind that 92 percent of respondents to the September 2000 Gallup poll opposed government agencies’ access to their medical records without their consent. By virtue of the Clinton/Bush medical privacy regulations, these respondents have lost the battle, although even now they and most other people do not know it. Owing to those regulations, another part of our independence and autonomy has slipped away.

References

Brase, Twila. 2001. Lawsuit against HHS and Medical Privacy Rule Is Step in Right Direction. Citizens’ Council on Health Care Press Release, July 16, St. Paul, Minn.

Gallup Organization. 2000. Public Attitudes toward Medical Privacy. Princeton, N.J.: Gallup Organization.

Heyne, Paul. 1997. "The Economic Way of Thinking.” 8th ed. Upper Saddle River, N.J.: Prentice Hall.

Paul, Ron. 2001. Medical Privacy Threatened by Federal Health Bureaucrats. Texas Straight Talk, June 18. Available at: http://www.house.gov/paul/tst/tst2001/tst061801.htm

Pear, Robert. 2000. U.S. Plans Tighter Rules on Medical Files’ Privacy. New York Times, Aug. 20, A14.

———. 2001. Medical Industry Lobbies to Rein in New Privacy Rules. New York Times, Feb. 12, A1, A17.

Stolberg, Sheryl Gay. 1998. Health Identifier for All Americans Runs into Hurdles. New York Times, July 20, A1, A13.

Twight, Charlotte. 1994. Political Transaction-Cost Manipulation: An Integrating Theory. Journal of Theoretical Politics 6, no. 2: 189–216.

———. 1997. Medicare’s Origin: The Economics and Politics of Dependency. Cato Journal 16, no. 3: 303–38.

———. 1998. Medicare’s Progeny: The 1996 Health Care Legislation. The Independent Review 2, no. 3: 373–99.

———. 1999. Watching You: Systematic Federal Surveillance of Ordinary Americans. The Independent Review 4, no. 2: 165–200.

U.S. Department of Health and Human Services (HHS). 1998. Unique Health Identifier for Individuals: A White Paper. Washington, D.C.: U.S. Government Printing Office, July 2.

———. Health Care Financing Administration (HCFA). 1998a. Health Insurance Reform: Standards for Electronic Transactions. Proposed Rule, May 7. Federal Register 63: 25272 ff. (Summary and Background), 25305 ff. (Proposed Rule).

———. 1998b. Health Insurance Reform: National Standard Employer Identifier. Proposed Rule, June 16. Federal Register 63: 32784 ff. (Summary and Background), 32796 ff. (Proposed Rule).

———. 1998c. National Standard Health Care Provider Identifier. Proposed Rule, May 7. Federal Register 63: 25320 ff. (Summary and Background), 25355 ff. (Proposed Rule).

———. 2000. Health Insurance Reform: Standards for Electronic Transactions. Final Rule, Aug. 17. Federal Register 65: 50312 ff. (Summary and Background), 50365 ff. (Final Rule).

U.S. Department of Health and Human Services (HHS). Office of the Assistant Secretary for Planning and Evaluation (OPE). 2000. Standards for Privacy of Individually Identifiable Health Information. Final Rule, Dec. 28. Federal Register 65: 82462 ff. (Summary and Background), 82798 ff. (Final Rule).

U.S. Department of Health and Human Services (HHS). Office for Civil Rights (OCR). 2001. OCR HIPAA Privacy Technical Assistance (TA), July 6. Available at: http://www.hhs.gov/ocr/hipaa/

* * *

This article is adapted with permission of the publisher from the article "Health and Human Services 'Privacy' Standards: The Coming Destruction of Medical Privacy," by Charlotte Twight, in The Independent Review: A Journal of Political Economy (Spring 2002, vol. VI, no. 4, p. 485-511). © Copyright 2002, The Independent Institute, 100 Swan Way, Oakland, Calif. 94621-1428; http://www.independent.org.

Charlotte Twight is a professor of economics at Boise State University.

Read more on this subject in related Hot Topics:

A product that might interest you:
Have an Opinion About This? Send an URGENT PriorityGram Today