Testimony before the
National Committee on Vital and Health Statistics
Subcommittee on Privacy and Confidentiality:

Public Hearing on Consent

Presented by Sue A. Blevins, President

Institute for Health Freedom

August 21, 2001

Thank you, Mr. Chairman and Committee members, for holding this timely public hearing to examine how the new federal medical privacy rule affects patient consent and the principles of health care ethics. I appreciate the opportunity to testify and focus on the concerns raised by thousands of citizens who recently submitted comments to the U.S. Department of Health and Human Services (HHS) opposing access to their personal health information without their consent.

The NCVHS Subcommittee staff asked witnesses to address one (or more) of four questions submitted to panelists. Today, I would like to address the following question:

"How, if at all, does the privacy rule affect the principles of health care ethics applicable to patient consent?"

The federal medical privacy rule that was published in the Federal Register on December 28, 2000 and approved by President Bush in April 2001 imposes a major shift in health care ethics applicable to patient consent. For the first time in our nation's history, the federal government is going to decide for each and every citizen who can access his or her personal health information, including genetic information. This is a major shift away from the precious health care ethics that we have honored for many years in this country: the ethics of consent, personal autonomy, and confidentiality.

Consent

In regard to disclosures of personal health information, the concept of informed consent has been defined as a person's agreement to allow personal data to be provided for research and statistical purposes.⁽¹⁾ The individual's agreement to share information is based on full exposure to the facts the person needs to make the decision intelligently. As explained in the book titled Private Lives and Public Policies: Confidentiality and Accessibility of Government Statistics, "informed consent describes a condition appropriate only when data providers [patients] have a clear choice. They must not be, nor perceive themselves to be, subject to penalties for failure to provide the data sought."⁽²⁾

The federal medical privacy rule does not meet this definition of consent. Rather, it coerces individuals into sharing their personal health information. The rule codifies a new ethical code for medical care in the United States: individuals now may be denied medical treatment for failing to share personally identifiable information for purposes of "health care operations"--a broad term encompassing many uses.

Personal Autonomy

Patient autonomy is another important health care ethic that is going to be severely affected by the federal medical privacy rule. Respect for personal autonomy is the most frequently cited moral principle in the literature on informed consent.⁽³⁾ It includes the ability to remain free from authoritative interference and to control one's personal affairs. Self-governance is the hallmark of personal autonomy. Since the federal medical privacy rule limits individuals' ability to control access to intimate details about their personal lives, the rule represents a major shift from personal autonomy toward authoritative control over individuals' personal lives.

Confidentiality

Confidentiality is another important health care ethic that is impacted by the new rule. For many years the patient-doctor relationship has been viewed as a sacred relationship. In fact, the Hippocratic Oath stresses confidentiality, noting "All that may come to my knowledge in the exercise of my profession or outside of my profession or in daily commerce with men which ought not to be spread abroad, I will keep secret and will never reveal if I keep this oath faithfully . . ."⁽⁴⁾ Nurses also have vowed to maintain patients' confidentiality over the years. The Florence Nightingale pledge states, "I will do all in my power to maintain and elevate the standard of my profession, and will hold in confidence all personal matters committed to my keeping and all family affairs coming to my knowledge in the practice of my profession."⁽⁵⁾

Today, the sacred doctor-patient relationship is in jeopardy. The incredible technological advancements that brought us high-tech, life-saving medical treatments have also increased the risk of medical privacy invasions. Additionally, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) lays the groundwork for a national health information system. Personally identifiable health information about millions of Americans soon will be coded according to national uniform standards. Sensitive patient information will be compiled, stored and transferred electronically over the Internet.

However, simply because we have new technology that facilitates the exchange of medical information electronically does not mean that we should eliminate the fundamental ethical concepts that have guided our physicians and nurses for years. Considering the forthcoming national health information system, we should be working toward strengthening--not weakening--the important ethical concepts of consent, personal autonomy and confidentiality. In fact, a majority of Americans strongly support informed consent when it comes to sharing their medical information.

National Gallup Survey on Medical Privacy

The Institute for Health Freedom commissioned a national Gallup survey to find out how Americans feel about medical and genetic privacy. We had heard from privacy advocates across the country about their concerns. But we wanted to find out how ordinary citizens across the nation--not just privacy advocates--feel about the issue.

The national Gallup survey was conducted between August 11 and August 26, 2000 and the results are posted at the Institute for Health Freedom's Web site: www.ForHealthFreedom.org. The survey of 1,000 adults nationwide found an overwhelming majority of Americans do not want third parties to have access to their medical records--including genetic information--without their consent.

• 95 percent say banks should not be allowed to see patients' medical records without individuals' consent;
• 92 percent oppose allowing governmental agencies access to patients' medical records without permission;
• 88 percent oppose letting police or lawyers review medical records without explicit consent;
• 84 percent say employers should not be allowed access to patients' medical records without permission; and
• 67 percent oppose researchers accessing patients' medical records without consent.

The national Gallup survey also included two important questions about genetic privacy. One asked whether doctors should be allowed to test patients for genetic factors without their consent. Only 14 percent of respondents would permit such testing; 86 percent oppose it.

The other question asked whether medical and governmental researchers should be allowed to study individuals' genetic information without first obtaining their permission. More than nine in ten adults (93%) feel medical and governmental researchers should first obtain permission before studying their genetic information.

What's more, when asked whether they are aware of a federal proposal to assign a medical identification number--similar to a Social Security number--to each American, only 12 percent said they had heard anything about it. College-educated adults (16%) are more likely than those with less than a college education (8%) to be aware of the proposal. Regardless of their knowledge about it, however, an overwhelming majority (91%) oppose the plan.

Even so, the Health Insurance Portability and Accountability Act of 1996 laid the groundwork for assigning each and every citizen an "Unique Health Identifier," a patient ID number that could be used to track medical information from birth to death.⁽⁶⁾ That plan has been put on hold temporarily until strong medical privacy protections are established. The federal medical privacy rule will govern disclosures of individuals' medical records tracked by Unique Health Identifiers.

Does the Federal Medical Privacy Rule Infringe on Individuals' Freedom to Enter into Private Agreements with Doctors? Does the Rule Strengthen or Weaken Consent?

As you probably know, the federal medical privacy rule went into effect on April 14, 2001 and health care organizations have up to three years to comply with the rule. Once the rule is in full effect, Americans are going to be asked to sign consent forms to release their medical information for "treatment, payment and health care operations." Yet it is not clear whether citizens are going to be fully informed about how many third parties can have access to individuals' medical information for treatment, payment and health care operational purposes.

It is also important to note that under the rule, individuals are not guaranteed the right to restrict access to their records for treatment, payment or health care operations.⁽⁷⁾ As stated previously, health care providers and institutions may refuse to treat patients if they won't give consent to share their medical records for these three broadly defined purposes.⁽⁸⁾

At the same time, individuals will not receive an accounting of how many times their medical records were disclosed and to whom their records were disclosed for treatment, payment and health care operations.⁽⁹⁾ Rather, they will receive only an accounting of disclosures for purposes other than treatment, payment and health care operations. Given that these purposes are so broad, most citizens are not going to have a clue as to how often their medical information--including genetic information--is shared by third parties.

The public is being told that under the federal medical privacy rule they can demandgreater privacy protections. However, they aren't being told that providers do not have to agree to patients' requests for stricter confidentiality. Moreover, even if a provider agrees to strict confidentiality, the rule says that such private agreements are preempted by section 164.512 of the federal medical privacy rule.⁽¹⁰⁾ This means that doctors cannot guarantee patients' strict confidentiality. Physicians are prohibited from entering into valid agreements with patients to keep their medical records private from many third parties, including (but not limited to):

• Federal and state officials monitoring oversight of the health care system
• FDA officials monitoring drugs, devices, and dietary supplements
• Foreign governments collaborating with U.S. public health officials
• Researchers conducting genetic research (if an IRB or privacy board waives patient consent)
• Law enforcement agents
• Judicial and administrative officials
• Licensure and disciplinary officials.⁽¹¹⁾

Why should citizens be concerned about the rule's impact on their ability to control access to their medical information? Because once individuals' medical records are disclosed to a third party (other than a business associate), the final rule no longer protects that information. The rule specifically reads:

". . .[O]nce protected health information leaves a covered entity the Department [HHS] no longer has jurisdiction under the statute to apply protections to the information."⁽¹²⁾

Also, there is nothing in the rule that prohibits the federal government, state governments or private parties from compiling large databases of patient information, for the purposes listed above, without patients' consent. The rule does not apply to information that is collected or stored in databases without consent prior to April 2003 (when most providers are required to comply with the rule). It states:

"We do not require covered entities with existing records or databases to destroy or remove the protected health information for which they do not have valid consents or authorizations. . ."⁽¹³⁾

What's more, the final rule does not cover the procurement or banking of blood, sperm, or body tissue. In fact, the final rule states:

". . .[T]he procurement or banking of organs, blood (including autologous blood), sperm, eyes or any other tissue or human product is not considered to be health care under this rule and the organizations that perform such activities would not be considered health care providers when conducting these functions."⁽¹⁴⁾

Because blood, sperm and body tissue includes genetic information, lack of privacy protections in these areas could have far-reaching effects for millions of Americans.

Recommendation

Given the strong public demand for medical privacy, it is important to consider the ramifications of prohibiting individuals from maintaining medical confidentiality. For example, will some stop seeking treatment for fear of privacy breaches? When responding to questions for national medical research, will individuals lie to prevent their sensitive information from being stored in large computerized databases and used by third parties without their permission? If so, that could seriously degrade the quality of medical research and statistical analyses in this country.

Finally, you asked for practical solutions to the current privacy rule debate. I offer the following recommendation to help ensure that America's high ethical health care standards are maintained:

It should be up to individuals--not the federal government--to decide to whom they want to disclose personal information. Individuals and their doctors (and other providers) should be free to enter into private agreements regarding disclosure of individuals' medical information--including genetic information.

Clearly, an individual's rights end when he or she becomes a threat to society. But until that burden of proof has been made clear, we must continue to uphold individuals' rights and the important health care ethics of consent, personal autonomy and confidentiality.

Conclusion

This Committee is probably going to hear a lot about the need to share patient medical information in order to promote the public's health. In view of that argument, it is important to note that we have seen incredible advancements in medical technology over the past 30 years during which citizens were free to enter into private agreements with doctors and other health care providers. Any federal rule that strips Americans of their freedom to seek private agreements with doctors and determine who sees their medical records infringes upon the long-standing traditions of personal autonomy and self-governance.

^1. George T. Duncan, Thomas B. Jabine, and Virginia A. de Wolfe, Private Lives and Public Policies: Confidentiality and Accessibility of Government Statistics (Washington, DC: National Academy Press, 1993).

^2. Ibid.

^3. Ruth R. Faden and Tom L. Beauchamp, A History and Theory of Informed Consent (New York: Oxford University Press, 1986).

^4. Helena Leino-Kilpi, Patient's Autonomy, Privacy and Informed Consent (Washington, DC: IOS Press, 2000).

^5. Ibid.

^6. The Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191).

^7. "Standards for Privacy of Individually Identifiable Health Information," Federal Register, Vol. 65, No. 250, December 28, 2000, p. 82810.

^8. Ibid., p. 82810.

^9. Ibid., p. 82826.

^10. Ibid., pp. 82552, 82553, 82822, 82823.

^11. Ibid., pp. 82525, 82528, 82813-82817.

^12. Ibid., p. 82631.

^13. Ibid., p. 82565.

^14. Ibid., p. 82477.