Medical Records Privacy
Hylene Dublin MSW, CGP, FAGPA

There is a flurry of activity in Congress regarding proposed legislation on access to medical and mental health records. One of the concerns in the medical records privacy debate is how to achieve adequate access to patient data, while providing sufficient identity protection for participating individuals. 

Discussion is underway in the Senate Health, Education, Labor, and Pension (HELP) Committee, as well as in the comparable committee in the House. While several years of work by members of Congress have already gone into drafting legislation, resolution of the issue will be complicated. Consumer advocates wanting strong protection are in conflict with the health care industry, which supports easy data management for large, multi-state health plans. This conflict has prevented action. Under the Health Insurance Portability and Accountability Act (HIPAA), however, Congress must take action by an August 1999 deadline, or the Secretary of Health & Human Services is authorized to issue regulations on medical records privacy.

Several bills have been proposed in the Senate, and according to David Pollack of Senator Edward Kennedy’s office, the HELP Committee is drafting another based on an amalgamation of three bills currently under consideration. Introduced by Senators Patrick Leahy (D–VT) and Edward Kennedy (D–MA), S. 573 contains the strongest protection for consumers. S. 578, introduced by HELP Committee Chair James Jeffords (R–VT) and Senator Christopher Dodd (D–CT), has some protective provisions but includes some elements of concern to mental health advocates. Senator Robert Bennett (R–VT) introduced S. 881, which supports the managed care industry’s position that greater uniformity and clarity in record-keeping are needed and that individuals should not have significant control over their medical information.

S. 573 is the strongest in protecting consumer privacy and granting consumers access to their own records. The bill requires safeguards to ensure privacy of medical information on the part of health care providers, health insurance plans, public health authorities, employers, researchers, law enforcement officials, and others who have access to health records. Individuals are to have prompt access to their own records and the right to amend them. Individuals’ consents for release of information must be truly informed consent. The bill limits the use of disclosed information to the purpose for which it was disclosed and prohibits those who receive protected information from passing it on to others. The bill retains existing state law when state law is more protective of privacy or allows the segregation of particularly sensitive portions of the records, such as psychotherapists’ notes, and permits greater restrictions on the disclosure of this information.

S. 578 stipulates that state law be retained when it is more protective of privacy and allows greater access to one’s own records. It also requires health plan operators and providers to secure the consumer’s authorization to disclose health information, but the plans are permitted to require such authorization in order for the individual to participate in the health care plan. Without such signed authorizations, individuals may be terminated from the plan. The bill does limit the use of procured information to the purpose for which it was disclosed and prevents the passing of this information on to others.

Regarding mental health provisions, Jeffords’ bill allows health care providers to deny an individual the right to access medical records if the provider (or carrier) believes that such disclosure would cause “substantial mental harm.” The objection to this provision raised by mental health advocates is that it is overly broad and would provide covered entities with unfettered and unnecessary discretion to deny people the right to inspect and copy their own mental health records. (A recent U.S. District Court in Florida (Doe v. Stincer) ruled that a Florida statute allowing facilities to deny requests for mental health records to former patients upon their request violated Title II of the Americans with Disabilities Act and “creates a barrier to access that discriminates against all individuals who receive treatment for any mental or emotional condition.”) Additionally, if psychotherapy notes were segregated, they would not be released with the general medical record and potential harm would be reduced. Jeffords’ bill fails to allow for this separation and permits health plans to demand these detailed documents for payment purposes.

On the House side, Representative Christopher Shays (R–CT), a member of a committee responsible for privacy legislation, has developed HR 3900, which also has very loose consumer protection provisions. Shays’ proposal would retain existing state laws regulating information; permit disclosure of information, without requiring consent, for purposes of treatment and payment of provider services; permit plans to require authorizations from consumers wishing to participate in their plans; and penalize providers and plans if they fail to have written policies for complying with requirements for medical records privacy. The bill fails to provide any incentives for health plans to strip identification from their records so that patients are unprotected from inappropriate disclosure of their medical and/or mental health information.

A coalition of provider and consumer groups, spearheaded by the Judge David L. Bazelon Center for Mental Health Law, is advocating for strong medical privacy protection of the managed care industry. The Bazelon Center, a not-for-profit organization committed to civil rights and human dignity in mental health practices, is actively monitoring Congress’ activity on this issue. Committed to working with congressional staff to secure the strongest possible protections of privacy for medical records, the Center joined with other organizations and sent a letter to Senator Jeffords outlining the group’s concerns with the proposed bills. Others signing the letter included the American Counseling Association, the National Alliance for the Mentally Ill, the National Association of Protection and Advocacy Systems, the National Council for Community Behavioral Healthcare, and the National Mental Health Association.

Mental health advocates want to ensure that a federal bill not pre-empt stronger state mental health privacy laws, including language to permit segregation of psychotherapy notes (so as not to be shared without the individual’s specific consent). They are also concerned with legislation that would permit equal access to records for individuals with mental as well as physical illnesses.

Given the dynamics of our health care industry, the unique issues involved in mental health care, and the explosion in the use of technology that will greatly facilitate the sharing of medical information, it is critical that medical records privacy concerns be addressed. The disparity between mental health and general medical records must also be considered. Will Congress be able to pass legislation by the August deadline, and will it be consumer friendly? If not, which of the foregoing provisions will be enacted by Health and Human Services Secretary Donna Shalala? Will the managed care industry be restrained in its wish for easy access to health records? By the time you read this, the word will be out.

This article was published in the August/September 1999 issue of The Group Circle.