ACLU Says New Medical Privacy Regulations, While Not Perfect, Represent Major Advance in Struggle to Protect Confidentiality

WASHINGTON – Saying it will continue to press for important improvements, the American Civil Liberties Union today called a new medical record regulation issued this morning by the Department of Health and Human Services a major advance in the struggle for medical confidentiality.

“In some ways the regulation remains flawed, particularly on the subject of law enforcement access to medical records,” said Barry Steinhardt, ACLU Associate Director. “But on balance, the regulation represents a significant step forward because it establishes a broad privacy principle in federal law and does not preempt state laws that provide even stronger protections.”

The new regulation implements a 1996 law in which Congress recognized the urgent need for federal medical privacy protections in an age of electronic record keeping. Although it gave itself a three-year deadline to approve new protections, Congress failed to meet its own timetable and therefore passed the responsibility for new regulation to HHS. Last year, the agency published a draft regulation, which it finalized today.

The final regulation contained several improvements suggested by the ACLU and other privacy advocates. Among the many improvements over the draft recommendations, the final regulation:

-Requires patient consent, even for purposes of payment, treatment and health care operations. The proposed regulation permitted health care providers to disclose health information without patient consent for these core functions.

-Deletes a catch-all privacy exception when health information is compiled for use by the government.

-Narrows the exceptions allowed for the disclosure of medical records in civil litigation and for health oversight activities.

“Going into the new year, our primary goal will be to work with Congress to strengthen medical privacy even further,” said Ronald Weich, an ACLU Legislative Consultant. “In addition, we will vigorously oppose any effort by Congress or the incoming Bush administration to weaken or block these important new privacy protections.”