Good afternoon. Mr. Chairman and Members of the Committee, thank you for the opportunity to present the views of pharmacist caregivers in hospitals, long term care facilities, community pharmacies and other practice settings across the country. I am Susan C. Winckler, Group Director of Policy and Advocacy for the American Pharmaceutical Association (APhA), the national professional society of pharmacists.
I am here to speak about the final regulation to protect the privacy of individually identifiable health information as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Specifically, I will discuss the regulation's requirement that health care providers, including pharmacists, must obtain prior written consent before any use or disclosure of protected health information.
Pharmacists are committed to protecting the privacy of individually identifiable health information, with specific responsibility for the patient health information gathered and used as an essential component of medication dispensing and drug therapy management. Pharmacists maintain and use individually identifiable information in patient records as an integral part of daily patient care and as important components of efforts to enhance quality and improve the safety of medication. The profession is concerned with protecting the privacy of the information they create, collect, and manage. Many pharmacies have confidentiality policies, and all pharmacists abide by patient privacy standards specified in state pharmacy practice acts, state board of pharmacy regulations, and other state laws.
Although APhA supports federal standards to address the privacy of health information, APhA is concerned that the final standards for privacy of individually identifiable health information will create substantial administrative and financial burdens that will disrupt patient care.
Prior Written Consent
Today, pharmacists work with physicians, other prescribers and patients to ensure that medications are used correctly - that this valuable technology yields the intended benefit. This includes the preparation and dispensing of the appropriate product, as well as ongoing monitoring and management of drug therapy. Pharmacists pride themselves on their ability to deliver these vital services to patients in a safe, timely and efficient manner. Unfortunately, the final rule, if implemented in its current form, will alter the interactions between pharmacists, physicians, and patients and affect the delivery of quality patient care.
The final rule requires that patients give written consent prior to the use or disclosure of individually identifiable health information for the routine purposes of treatment, payment and
health care operations. Under the rule, pharmacists will not be allowed to use any patient information before obtaining the patient's consent. If the pharmacist does not have a patient's consent on file, any activities associated with the preparation of a patient's prescription simply cannot occur. This includes entering the prescription information into the pharmacy's computer system, preparing the prescription, transmitting information to third party payors, communicating with the prescriber about the patient, and countless other activities. Without a patient's consent, a pharmacist can do nothing more with a patient's prescription than set it aside and wait for the patient to arrive and provide written consent.
The prior consent requirement, in effect, erects significant barriers to the quick, efficient, and safe delivery of health care that patients consistently count on pharmacists to provide. This requirement is overly restrictive and a substantial deviation from the 1999 proposed rule, in which the concept of prior consent was considered, rejected and replaced with a statutory authorization. According to the proposed rule, prior consent is unworkable, unrealistic, and would not provide meaningful privacy protections.(1) Other attempts to enact prior consent requirements have failed. A 1999 Maine law that required prior consent for disclosure of protected health information was repealed after 12 days because of patient complaints.(2)
Impact on Patient Care
As stated, the prior consent restraints will hinder the timely deliver of patient care. Allow me to present you with a few specific examples. Last year alone, community pharmacists prepared approximately 3.1 billion prescriptions - a number that is expected to grow exponentially in the next five years.(3) A large number of those prescriptions were phoned-in by a physician or transferred from another pharmacy. Under the final rule, a pharmacist cannot prepare the prescription until the patient arrives at the pharmacy and provides written consent. The delay created by the prior consent requirement can cause patient inconvenience and delay access to treatment - including instances where quick access to treatment is paramount. For example, a mother with an ill infant will not be able to pick-up an antibiotic phoned-in by her pediatrician until she arrives at the pharmacy, reads, and completes a consent form. Another common situation occurs when a prescription is brought to the pharmacy by someone other than the patient - this is especially frequent for elderly and infirm patients. In this situation, a pharmacist will not be able to prepare the prescription until a consent form is delivered to the patient, signed, and returned to the pharmacy.
The problems with a prior written consent requirement extend beyond the situation of advance preparation of prescriptions. In some situations, such as the identification of a contaminated, counterfeit, or ineffective product, urgent notification of the patient is required. For example, pharmacists use individually identifiable information to contact patients who have received a specific medication that is the subject of a recall by the Food and Drug Administration (FDA). Or in the extremely rare case we saw last week, patients who may have received an over-diluted dose of chemotherapy medication needed to be identified and contacted immediately. It is unclear whether such use of patient information would be appropriate without prior consent, or whether pharmacists would be allowed to review records only for those patients who have signed a consent form. Even if these situations fit the exception for emergency circumstances, any hesitation caused by concern for compliance with this regulation is unacceptable - but such hesitation could occur.
Restrictions on Consent
Under the final rule, patients are also allowed to restrict the uses and disclosures of their health information. APhA understands and supports the ability of patients to request restrictions on the use and disclosure, but we are also concerned that restrictions for treatment, payment, and health care operations could lead to increased patient risk. For example, a patient may request a restriction on the use and disclosure of information related to mental health medications. This often occurs when a patient does not want information about a particular prescription transmitted to a third-party payor or other health care professionals. If the pharmacist agrees to the restriction, the pharmacist will be prohibited from disclosing any information about the patient's medications. Although APhA is less concerned about payment restrictions, in certain situations restrictions on treatment or health care operations could erect barriers to patient care and place the patient at risk. As an illustration, a patient brings in a new prescription for a medication and the pharmacist identifies a potential drug interaction with a mental health medication the patient is also taking. The pharmacist can call the physician that prescribed the new medication and suggest that the medication be changed because of a potential drug interaction, however, the pharmacist cannot inform the physician what other medications the patient is taking. Because of the potential for risk - and a possible conflict between the patient restrictions allowed under the privacy regulation and pharmacist requirements in state practice act - it is unlikely that pharmacists would agree to such a request. Is it appropriate, then, to even offer such restrictions if they cannot be granted?
It is imperative that the prior written consent requirement does not prevent pharmacists from communicating with other providers when it is in the patient's best interests to do so. As I described, the inability for two providers to share patient information can place the patient at risk - and it can also prevent the patient from receiving the best quality treatment available. When appropriate, providers must be free to consult with colleagues and other health care providers or to refer the patient. Patients place a great deal of trust in their pharmacist to provide them with quality health care and pharmacists recognize and respect this relationship. In fact, as described by the Pharmacist's Code of Ethics, "A pharmacist promotes the good of every patient in a caring, compassionate, and confidential manner."(4) Requiring prior written consent for these activities will create administrative obstacles and may discourage providers from seeking the most effective and appropriate treatment for their patients.
The final rule's restrictions on uses and disclosures of protected health information may also create additional communication barriers between providers. The rule limits the use and disclosure of individually identifiable health information to the "minimum necessary" except when disclosed to another provider for treatment purposes. APhA strongly supports the minimum necessary exclusion for treatment purposes because pharmacists must be able to access and contribute to a patient's health record in order to work with patients and ensure appropriate medication therapy. However, providers might be reluctant to share information in an attempt not to violate the minimum necessary requirement. A clarification is needed to ensure that providers have access to and the ability to use, not just disclose, health information for treatment purposes.
The regulation may also have the opposite effect than what was intended. Patients who provide prior written consent may not understand the protections provided to them or the restrictions on those protections under the complex privacy regulation. In some cases, patients may get an over-inflated sense of the control they have over their medical record. Or in other cases, patients may become so accustomed to providing written consent that they sign consent and authorization forms with little regard to their content or the distinct purposes served by the documents. In this situation, patients may unknowingly provide their authorization to any number and type of uses and disclosures. The prior written consent requirement could detract from the rule's goal of providing patients more control over their health information and more access to quality health care.
Impact on Pharmacy
The prior consent requirement will also have a significant impact on pharmacists' ability to serve as an integral member of the health care team. Under the final rule, pharmacists will have to obtain signed consent forms from more than 200 million Americans prior to the April 14, 2003 compliance date. Although patients are familiar with paperwork requirements associated with a visit to the doctor or enrolling with an insurance company, patients have not been subject to similar practices at the pharmacy. Providing prior written consent at a pharmacy is a complete departure from a patient's expectations and a pharmacy's normal practices. Pharmacists will have to inform and explain the consent form and the Notice of Privacy Practices to each of their patients. As previously stated, pharmacists are concerned with protecting the privacy of their patients' health information, however, the administrative burdens on patients and pharmacists do not appear to be offset by any large benefit from the consent requirement. The administrative duty will divert pharmacists from their primary duty -- providing patients with the appropriate medication and quality medication therapy management services -- and may exacerbate the current shortage of licensed pharmacists.
[According to the study, "The Pharmacist Workforce: A Study of the Supply and Demand for Pharmacists," released by the Department of Health and Human Services' (HHS) Health Resources and Service Administration (HRSA) in late 2000, there is currently a shortage of licensed pharmacists. A sharp increase in the demand for pharmacists services, coupled with the large portion of time pharmacists must spend interacting with third-party payors, has reduced a pharmacist's ability to deliver quality health care. The administrative burdens created by the final regulation will further restrict pharmacists' ability to provide safe, efficient, and timely services to their patients.]
Pharmacy Compliance
Since the final rule was released last December, APhA and the pharmacy community in general have been reviewing the rule and trying to determine what pharmacists must do in order to comply. This has not been an easy task. The length of the regulation and the number of entities covered by the regulation prevented HHS from addressing every situation or implementation question specific to pharmacy. Several areas of the final rule are vague and create questions on what must be done for pharmacy to fully comply with the rule.
For example, under the final rule's prior consent requirement, covered providers must make take reasonable precautions against accidental disclosures. However, the rule does not provide any clarity on what type of "reasonable" precautions a provider must take. Would this requirement prevent pharmacists from utilizing common tools such as prescription log books, public address systems, or semi-private counseling areas? The guidance document released by HHS last month did clarify some of the questions the pharmacy community had posed to HHS. For example, the guidance confirmed that a friend or family member may pick-up a patient's prescription if it is the pharmacist's "best judgment" that it is in the best interests of the patient.(5)
The guidance also clarifies that a pharmacist may provide advice about over-the-counter medicines without obtaining a patient's prior written consent, provided that the pharmacist does not create or keep a record of any protected health information revealed.(6) Although this would allow pharmacists to counsel patients, it is contrary to good patient care. A complete patient profile that includes over-the-counter medicine use is a vital tool for pharmacists to identify potential drug interactions between over-the-counter medicines and prescription drugs. Again, the final rule erects barriers to good patient care.
The guidance raises more questions than it answers. According to a HHS press release announcing the guidance document, "HHS also expects to propose appropriate changes to the rule in order to ensure that it does not adversely affect patients' access to quality health care. For example, Secretary Thompson has said he intends to propose modifications to ensure that a pharmacist can fill a phoned-in prescription for a new patient, even when the pharmacist does not first have the patient's signed consent on file."(7)
While APhA is pleased that HHS recognizes the need to make modifications to the final rule, the promise of additional guidance documents and future modifications do not help pharmacists with their immediate problem - coming into compliance with the rule prior to the April 14, 2003 deadline. HIPAA required that covered entities have two years to comply with the regulation. HHS' belief that "most covered entities have two full years [emphasis added] from the date that the regulation took effect - or, until April 14, 2003 - to come into compliance with these standards," is simply not true.(8) Pharmacists will not have two years to work towards compliance as the two year time period started several months ago and it still not clear how the prior written consent requirement will apply to the profession. The promise of modifications to the final rule, and in particular the prior written consent requirement as it applies to pharmacy, has effectively limited any efforts pharmacists could reasonably undertake to begin compliance activities - especially when no timeline for the release of guidance or modifications is available. It is unreasonable to expect providers to devote considerable financial and staff resources to compliance activities when modifications to the rule may make that investment moot.
Recommendations
APhA and a coalition of more than 80 other health care providers have requested that HHS move as expeditiously as possible to make modifications to the final rule. In a comment letter to HHS, APhA also recommended several different possible modifications to the prior consent requirement. First, APhA strongly recommends that the prior written consent requirement revert to the statutory authorization concept that was in the proposed rule. Such a changed would ensure appropriate use of information for treatment, payment and health care operations and support quality care. Further, it would help patients and providers distinguish between activities that do not require consent (treatment, payment and health care operations) and other activities such as marketing that require an authorization.
Alternatively, the regulation could be modified so that the very act of bringing a prescription to the pharmacy or having a prescriber call the prescription in qualifies as implied patient consent. By presenting a prescription to a pharmacist, the patient has implied consent for the pharmacist to prepare and dispense the prescription.
If reversion to statutory authorization or implied consent is unworkable, APhA strongly urges that the consent requirement be modified to remove the word "prior" for treatment, payment and health care operations. This would allow pharmacists to provide patients with the quality health services they expect from pharmacists without creating severe disruptions in the health care system. The substantial administrative impact of securing consent would remain, but disruptions may be minimized with the elimination of the prior requirement.
Another option involves modifying the rule to allow the patient to provide one consent form for all treatment, payment and health care operations. The single consent form would extend to all of the entities covered by the rule. Under this option, patients could provide consent at the initial point of care, such as the physician's office. This consent form would allow the physician to disclose patient information to pharmacists and other providers which, in-turn, would be allowed to use and disclose patient information for the purposes of treatment, payment, and health care operations.
In conclusion, it is imperative that HHS delay the compliance date until two years after the final modifications have been made to the rule. The requirements in the final rule will substantially alter pharmacy operations, and compliance will require at least two years of preparation.
Thank you for allowing me to present the views of the nation's pharmacists on this important issue. We appreciate your concern with the impact of these regulations on patients and providers. APhA looks forward to working with you and the Department of Health and Human Services to ensure that this well-intentioned rule does not have adverse effects on patients' ability to access quality health care.
1 64 Federal Register at 59,941
2 "Medical Privacy Regulation: Questions Remain About Implementing the New Consent Requirement." U.S. General Accounting Office. April 2001.
3 "Industry Statistics." National Association of Chain Drug Stores.
4 American Pharmaceutical Association. Code of Ethics for Pharmacists. Adopted October 27, 1994.
5 "Guidance: Standards for Privacy of Individually Identifiable Health Information." Department of Health and Human Services Office of Civil Rights. 6 July 2001. Page 10.
6 Id., p. 9.
7 "HHS Issues First Guidance on New Patient Privacy Protections." Department of Health and Human Services." 6 July 2001.
8 "HHS Fact Sheet: Protecting the Privacy of Patients' Health Information." Department of Health and Human Services. 9 May 2001.