Understandably, physicians and patients have been focusing almost exclusively on the hassles and bureaucratic forms required to comply with HIPAA. But the loss of the right of consent in the new Privacy Rule imposes several subtle and several more obvious problems and potential conflicts on every part of the system. While the federal Privacy Rule requires "covered entities" to fully inform patients of their rights under state and common law, this is just not being done. The privacy notices being given to patients across the nation are not only defective, misleading and inadequate, but illegal.
Federal regulations provide the floor for patient privacy, not the ceiling. The Rule still requires providers to give patients notice about how to utilize the greater medical privacy protections contained in state laws. It further specifies that health care professionals should continue to use and follow the longstanding professional codes of ethics for their field or specialty and should develop privacy policies and notices in accordance with these traditional ethical principles. Yet HIPAA legal experts have simply not advised providers of the full extent of their legal and ethical obligations under the Privacy Rule.
Privacy notices typically imply that patients have lost the right of consent, in flagrant violation of the core ethical principle of every medical and health profession. What does your privacy notice say? Does it cite the American Psychiatric Association and American Medical Association (AMA) Codes of Medical Ethics on the right of consent? Most privacy notices do state that patients have the right to request a consent process; but under the federal Privacy Rule, providers have no obligation to provide one. Although privacy notices are required to inform patients that more stringent state laws and medical ethics governing the right of consent actually prevail over the federal Privacy Rule, I have yet to find a single privacy notice that does that.
As a matter of record, defective privacy notices are part of the basis for a lawsuit filed against the U.S. Department Health and Human Services (HHS) on April 10, 2003, in federal district court in Philadelphia. The lawsuit was filed on behalf of the American Psychoanalytic Association and 15 other health and advocacy organizations and individuals. Its main purpose is to overturn the amendments to HIPAA and restore the right of consent (see Citizens for Health et al. v Tommy G. Thompson, Secretary, US Dept of HHS, CA No. 03-2267 [E.D. Pa.]). The lawsuit cites three typical "privacy notices" from national corporations that did not advise patients of the existence of more stringent state and common laws governing medical privacy, did not advise patients about ethics governing medical privacy, and also failed to inform them about how to exercise their rights under state laws. For example, a privacy notice that states "stricter state laws may provide greater protections for people with HIV or AIDS" is totally inadequate. Surely HHS did not intend for each citizen to be forced to become an expert on the medical privacy statutes in their state.
Many hospitals and academic institutions view the right of consent as inefficient, or as a barrier or impediment to treatment or research, rather than viewing the body of laws and ethical principles as necessary and important conditions of effective treatment. But psychiatrists know from direct experience just how far many parents and patients will go to protect their children or their jobs, and to hide or omit information to keep others from knowing intimate personal or family secrets. Our patients will not share any sensitive information at all if they believe it can be accessed by anyone other than the person who is treating them.
The U.S. Supreme Court recognized that effective psychotherapy cannot exist without the guarantee of absolute privacy. In Jaffee v Redmond (No. 95-266 ), the justices rejected any balancing test to weigh the needs of private individuals or entities against the right of patients to have privacy. The court noted that it was in the best interests of the nation to have effective psychotherapy available for citizens, so they affirmed the absolute right to privacy of the communications between patient and psychotherapist by recognizing a federal therapist-patient privilege.
Advocacy for patients and protection of patient privacy are core ethical principles for physicians and most health professionals. Therein lies the moral and ethical guidance our nation needs. Section III in the Preamble of the AMA Principles of Medical Ethics (2001) affirms the physician's role as an advocate for patients, stating, "A physician shall respect the law and also recognize a responsibility to seek changes in those requirements which are contrary to the best interests of the patient." Section IV in the Preamble states, "A physician shall respect the rights of patients, colleagues, and other health professionals, and shall safeguard patient confidences and privacy within the constraints of the law." Both principles are incorporated into the Principles of Medical Ethics of the APA.
Here are some tangible steps you can take to safeguard patient privacy, advocate for the best interests of patients and inform the public: