The right of consent, which gives individuals the power to keep personal health information private, has always been recognized under state law and has always been strongly upheld by state and federal courts. When President Bush made the Health Insurance Portability and Accountability Act (HIPAA) the law of the land in April 2001, the Privacy Rule gave every American the federal right to consent to the release of their medical records.
Originally, the HIPAA Privacy Rule did in fact protect every citizen's right to medical privacy, and Bush was lauded as the Privacy President. But behind the scenes, powerful corporate interests worked to turn it into its polar opposite, a "disclosure rule." The Bush Administration opened the door so that the hospital and insurance industries could amend the privacy regulations. Distracted by war, we missed completely the elimination of our precious constitutional right to privacy, the right to be let alone, as the so-called Privacy Rule went into effect.
A massive campaign of disinformation has led the media and public to blind acceptance of the Administration's claims that HIPAA will increase medical privacy protections. In actuality, the amendments to the HIPAA Privacy Rule surgically excised every citizen's right of consent to release their medical records and replaced it with a new doctrine of federal "regulatory permission" (67 Fed. Reg. 53,182, Aug. 14, 2002). This new right of access given to over 600,000 "covered entities" and their innumerable "business associates" allows them to access every American's cradle-to-grave medical records without consent, without notice and without recourse. It is unlikely that any identifiable health information, past or future, will be immune from use and disclosure under this new standard. This technical exception, embedded deep in the several-inch-thick Rule, created a loophole the size of Texas that insurers, employers, banks, state and federal agencies, and all their "business associates" can drive through with truckloads full of medical records. (Final modifications to the Privacy Rule, in the Aug. 14, 2002, Federal Register and the Complete Privacy Rule Text, as modified Oct. 10, 2002, are available at <www.hhs.gov/ocr/hipaa/finalreg.html>.)
The loss of meaningful consent for patients will have far-reaching consequences for medical care in the United States. These consequences have yet to be understood by most physicians, not to mention the public, the media or arguably even the promulgators of this impending disaster. Even if treatment is paid for out-of-pocket or an individual never has another contact with the health care system, their personal health information may now be accessed. The amendments to the HIPAA Privacy Rule grant breathtakingly broad and unprecedented powers to both private corporations and government entities to collect and amass the individual medical data of every person in the United States. Never in history has such a crucial right been eliminated for every member of the population.
The loss of consent will insidiously yet radically alter the physician-patient relationship and destroy the trust that patients must feel to share sensitive and painful medical and mental health information with all health care professionals.
Will there be a physician or patient or consumer-led uprising? Not necessarily. But there will inevitably be a profound shift in patient behavior. People refuse treatment when they believe their diagnosis or prescription records will be seen by employers, insurers and bankers and used to discriminate against them. When patients realize neither they nor their doctors have the right to stop the flow of sensitive medical information out of doctors' offices and other treatment sites, they will fight back. Patients will begin to avoid or leave doctors and hospitals that use their medical records without permission. They will avoid treatment for as long as possible, they will omit sensitive information, or they will provide false information to try and protect themselves.
The elimination of the right of consent will provide fertile ground for a black market in private medical treatment for those who can afford it. The only other guarantee of medical privacy will be to get treatment under an alias. If the doctrine of federal "regulatory permission" is not reversed through litigation or legislation by the U.S. Congress, the currently existing stronger protections for medical records in the states will likely be eliminated in order to bring state laws into conformity with HIPAA. Powerful industries that profit from access to identifiable medical information will introduce legislation in every state to eliminate consent and conform with the limitless disclosures allowed under HIPAA. This has already happened in Texas and Oregon.
