HHS issues HIPAA privacy rules

October 1, 2002

Pharmaceutical Representative

The Department of Health and Human Services has issued the final privacy rules required by the Health Insurance Portability and Accountability Act.

The Department of Health and Human Services has issued the final privacy rules required by the Health Insurance Portability and Accountability Act. The final regulation, which takes effect April 14, 2003, guarantees patients access to their medical records, gives them more control over how their protected health information is used and disclosed, and provides an avenue of recourse if their medical privacy is compromised. The rule will protect medical records and other personal health information maintained by certain healthcare providers, hospitals, health plans, health insurers and healthcare clearinghouses.

"Patients now will have a strong foundation of federal protections for the personal medical information that they share with their doctors, hospitals and others who provide their care and help pay for it," said HHS Secretary Tommy Thompson. "The rule protects the confidentiality of Americans' medical records without creating new barriers to receiving quality healthcare. It strikes a common-sense balance by providing consumers with personal privacy protections and access to high-quality care."

New protections

Under the privacy rule:


•Â Patients must give specific authorization before entities covered by this regulation can use or disclose protected information in most non-routine circumstances - such as releasing information to an employer or using information in marketing activities.


•Â Covered entities generally will need to provide patients with written notice of their privacy practices and patients' privacy rights. The notice will contain information that could be useful to patients choosing a health plan, doctor or other provider. Patients will generally be asked to sign or otherwise acknowledge receipt of the privacy notice from direct treatment providers.


•Â Pharmacies, health plans and other covered entities must first obtain individuals' specific authorization before sending them marketing materials. At the same time, the rule permits doctors and other covered entities to communicate freely with patients about treatment options and other health-related information, including disease-management programs.


•Â Marketing language has been strengthened to clarify that covered entities cannot use business associate agreements to circumvent the rule's marketing prohibition. The improvement explicitly prohibits pharmacies or other covered entities from selling personal medical information to a business that wants to market its products or services under a business associate agreement.


•Â Patients generally will be able to access their personal medical records and request changes to correct any errors. In addition, patients generally will be able to request an accounting of non-routine uses and disclosures of their health information.

No effect on reps

Many pharmaceutical sales representatives have expressed concern that the new rules will be used as a reason to bar them from doctors' offices, but Bill Pierce, a spokesperson for HHS, said there is nothing in the rule that is directed at pharmaceutical reps. Though he would not venture a guess as to what parts of the rule might be misinterpreted by doctors, he encouraged people to contact the Office of Civil Rights, which conducts outreach and education targeted to groups and people affected by the regulation.

"We encourage everybody to read the rule carefully and ask us, the Office of Civil Rights, if they have any questions," Pierce said. "We're happy to meet with groups, organizations, companies, etc., or talk to them on the phone to ensure a successful implementation." PR

Related Content:

News