Attorney: HIPAA Rules Suit Gains Backing

By Michael Ha

NU Online News Service, April 21, 10:52 a.m.EDT?The lead attorney for a lawsuit contending new federalrules designed to protect medical treatment record privacy areflawed said public support for the action has beenenthusiastic.

Attorney James C. Pyles said, since a coalition of mental healthcare providers and patient groups filed the action last week inU.S. District Court in Philadelphia, he has been inundated withresponses from the public. "And we have gotten lots of requestsfrom people who want to be added as plaintiffs."

The lawsuit on behalf of privacy groups and other organizationsfrom around the country challenges regulations drawn up by theHealth and Human Services Department to implement the HealthInsurance Portability and Accountability Act.

Named as lead defendant in the action is Department of Healthand Human Services Secretary Tommy G Thompson. The complaintcharges that privacy rules amended by HHS last August eliminateprivacy protections for personal health information.

Challenged are sections of the rules which allow certain groups,including insurance companies, to use and disclose personal healthinformation--such as treatment, payment and health careoperations--without consent and regardless of the patient'swishes.

"We are seeking to declare invalid the portions of amendments inHIPAA that eliminated the right of consent" by patients beforerecords could be disclosed, Mr. Pyles said.

"It's filed to restore the right of consent for consumers, whichthe HHS' own rulemaking record says is essential for quality healthcare. And we believe strongly that it is true," Mr. Pyles toldNational Underwriter.

The HIPAA, which is designed to facilitate the storage andtransmission of health information by computer while protectingpatients' rights, prohibits hospitals, pharmacies, insurancecompanies and other health care groups from using or disclosinghealth information for non-routine purposes without patientpermission.

Still, routine disclosures--which include treatment, payment andhealth care operations--are permitted without the patient'sknowledge or consent and without any accounting, Mr. Pylessaid.

Violators could face civil and criminal penalties up to $250,000in fines and 10 years in prison. However, interim regulationspartially implementing the sanction provisions were only issuedApril 17 and do not go into effect for at least 30 days, Mr. Pylessaid. Further, the privacy rule directs the Health and HumanServices Secretary to seek to resolve violations informally firstbefore invoking sanctions.

According to the lawsuit's complaint, despite sanctionprovisions, the new law would end up giving insurance and drugcompanies more access to individual medical records withoutpatients' permission.

Among the insurance related sections of the rules are provisionsdesigned to exempt the transmission of data needed to processworkers' compensation claims.

"What we are finding is that many patients really object tothat, particularly among cancer survivors and those who don't wantpictures of their breast surgery traveling around the Internet.They would rather not have that happen," Mr. Pyles said.

"This was not permitted before without their consent. But nowit's permitted even when patients object."

He explained that the lawsuit was filed in Philadelphia as asymbolic gesture, "because that's where the right of liberty wasoriginally adopted as a constitutional right and we thought it wasappropriate that it either be preserved or that it die there."

The plaintiffs include the Washington, D.C.-based Citizens forHealth; American Association for Health Freedom in Great Falls,Va.; American Association of Practicing Psychiatrists inKensington, Md.; St. Louis-based American Mental Health AllianceU.S.A.; American Psychoanalytic Association, based in New York;National Coalition of Mental Health Professionals and Consumersfrom Commack, N.Y.; and New Hampshire Citizens for Health Freedomin Keene, N.H.