We Need a Tough Law on Medical Privacy

        By T. Evan Schaeffer

        In the last few years, the federal government has finally become involved in protecting the privacy of our medical records.  But is it a case of too little, too late?

        Most recognize the need for a tough medical privacy law.  A recent Gallop poll found that almost eight in 10 adults think it is "very important" that their medical records be kept confidential.

        This doesn't always happen.  One problem is inadvertent leaks caused by a failure to safeguard medical information at the source.  Two years ago, for example, a Michigan hospital accidentally posted the medical records of thousands of patients on the Internet.

        Often the leaks are more sinister in nature.  In 1993, a major pharmaceutical company used a list of 5 million patient names to market a drug to elderly incontinent women.  Last year, a Utah-based pharmaceutical benefits company used patient data to solicit business for a drugstore.

        Do you think your medical records should be used for private gain?  Throw into the mix employers who use confidential medical information to discriminate against sick employees, or insurers who do the same, and you begin to appreciate the need for strict privacy safeguards.

        But is the federal government doing enough to safeguard our medical privacy?

        In April 2001, the privacy portion of the Health Insurance Portability and Accountability Act took effect.  Health care providers have until April 2003 to meet the new regulations.

        It's a start, but the regulations aren't tough enough.  Since the beginning of the debate 10 years ago, the federal government has been too soft on those who want our medical information for private gain.

        While news reports have claimed that the new regulations require patient consent for disclosure of medical information, this is often not the case.  Medical information can be disclosed without consent in many instances, which dilutes the impact of the law.

        Want to know who has used your medical information?  Even under the new regulations, you often don't have the right to know, as long as those who give away the data can argue the disclosure was justified.

        Another shortfall is that the new regulations do not provide serious penalties for breaches of medical privacy.  A patient can complain to the U.S. Department of Health and Human Services, but the agency is not required to take action.  Even worse, a patient is not entitled to sue for violations of medical privacy.

        The new federal regulations are a step in the right direction.  But one step isn't enough.  As long as we have to depend on a federal law to protect the privacy of our medical information, we should demand that it be tough.

Back