Eagle Forum
EF Twitter
Medical Privacy Regulations

Public comments may be mailed to the address below, or submit electronic comments here:
http://aspe.hhs.gov/admnsimp/ (This site has been reported to be out of commission at times)


U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attention: Privacy-P
Room G-322A, Hubert H. Humphrey Building
200 Independence Avenue, SW
Washington, D. C. 20201

Dear Assistant Secretary,

While the medical privacy regulations published on November 3, 1999 in the Federal Register, in accordance with the Health Insurance Portability and Accountability Act (HIPAA), provide positive first steps to protecting patient privacy, the regulations also have many pitfalls and loopholes.

Two strengths of the proposed regulations are that 1) the Privacy Act and the Family Educational Rights and Privacy Act (FERPA) are specifically upheld, and 2) state privacy and parental involvement laws are not preempted therefore allowing states to pass "more stringent" state medical privacy laws.

Though the proposal stipulates that parental notice and consent laws regarding abortion, for instance, are not affected, I am troubled by the inclusion of "minors" in the definition of an "individual." We should agree that parents have a fundamental right to care for their children. Yet your regulations, like some federal laws, begin with an assumption that minor children should control their own medical records, unless state laws say otherwise.

If in Maryland, for instance, the law is silent about parental involvement when a minor receives free needles for intravenous drug use, under your medical privacy regulations the provider must assume that the minor, as an "individual," is free to control his own medical record. This assumption is a dangerous usurpation of parental rights.

Furthermore, while FERPA is upheld, your regulations state that school-based clinics should keep health records separate from other educational files. Why? Today under FERPA, parents can access their children's educational files. However, if a nurse hands a minor a condom and writes the information in his health record, your regulation suggests that in the absence of a state law, his parents may not have a right to access his now-separate health file. This scenario violates the spirit, if not the letter, of FERPA in addition to overruling parents' right to protect their children's health and well being. The federal government has no right to seal off children's health records from their parents in the name of "privacy."

One positive aspect of the regulations is that patients have greater control over the flow of their personal health information in the private sector. Patients have a right to notice, consent, access, and correction. For instance, patients can opt-in to a system to receive telemarketing product offers. Yet, if patients elect to withhold consent, they can not be penalized, such as by being denied future medical coverage. However, a false sense of security is created by these protections because patients do not completely control their health records as a result of specially carved out exceptions and so-called "national priorities."

Patients do not have to provide consent for any of these "priorities." For treatment, payment, or health care operations, patient consent is not required under the proposal, but it should be. In addition, researchers have great access to personal health information, and patients must rely on unaccountable privacy boards for protection. Patients should not be research subjects unless they consent.

The proposed regulations maintain current practices that permit public health officials an open door to accessing personal health information without patient consent. However, the proposed regulations expand the definition of a public health official to include government officials from agencies such as the EPA, NTSB, OSHA, FDA, and others. This broad definition is quite troubling and entirely unacceptable. Public health official access should be more limited, and patient consent should still be required.

Furthermore, under the proposed regulation, health care providers may give health records to the government for inclusion in a federal health care data system, which would contain medical information on every citizen. Government should not be permitted to collect personal health information, especially without patient knowledge or consent. In addition, these regulations permit states to continue collecting and storing health data, such as in immunization registries, without patient consent. In the absence of state law, patients have no opportunity to object to their immunization records' entry into a database.

Although contrary to the Fourth Amendment, your regulations permit law enforcement officials to access personal health information without a court warrant. Any protections put into place are limited by an even broader loophole that permits the police to review personal health information when attempting to identify a suspect. In these cases, all computerized health records contained in databases could be searched by DNA, blood, or other health traits without patient knowledge or consent, which leaves the door open to widespread abuse.

The proposed regulation specifies that health records must contain a list of all disclosures, but in some instances for national priorities, disclosure entries may be omitted. Therefore, without an entry in the health record, patients will never know that their personal health information was accessed. Under the proposed regulations, patients may have strong medical privacy protections when it comes to the private sector, but government at all levels has a free ticket to access personal health information without patient knowledge or consent, all in the name of priorities determined by the federal government.

The draft proposal contains some important protections, but the exceptions and loopholes must be closed in order to provide complete medical privacy for every American. I hope that my comments will assist you in that process.


[your name]
[your address]
[your phone number]

Google Ads are provided by Google and are not selected or endorsed by Eagle Forum
Eagle Forum 200 West 3rd St. • Alton, IL 62002 phone: 618-433-8990 eagle@eagleforum.org