HIPAA Rules Suit Gains Backing

The lawsuit challenges regulations drawn up by the Health and Human Services Department to implement the Health Insurance Portability and Accountability Act, and it names Department of Health and Human Services Secretary Tommy G. Thompson as lead defendant in the action.

The complaint, Mr. Pyles said, charges that privacy rules amended by HHS last August eliminate privacy protections for personal health information.

Challenged are sections of the rules which allow certain groups, including insurance companies, to use and disclose personal health information–such as treatment, payment and health care operations–without consent and regardless of the patient's wishes.

"We are seeking to declare invalid the portions of amendments in HIPAA that eliminated the right of consent" by patients before records could be disclosed, Mr. Pyles said.

"It's filed to restore the right of consent for consumers, which the HHS' own rulemaking record says is essential for quality health care. And we believe strongly that it is true," Mr. Pyles told National Underwriter.

The HIPAA–which is designed to facilitate the storage and transmission of health information by computer while protecting patients' rights–prohibits hospitals, pharmacies, insurance companies and other health care groups from using or disclosing health information for non-routine purposes without patient permission.

Still, routine disclosures–which include treatment, payment and health care operations–are permitted without the patient's knowledge or consent and without any accounting, Mr. Pyles said.

Violators could face civil and criminal penalties up to $250,000 in fines and 10 years in prison. However, interim regulations partially implementing the sanction provisions were only issued April 17 and do not go into effect for at least 30 days, Mr. Pyles said. Further, the privacy rule directs the Health and Human Services Secretary to seek to resolve violations informally first before invoking sanctions.

But for the property-casualty insurers, one industry expert contends that even with provisions for routine disclosures, which are now being challenged by the lawsuit, HIPAA could still spell trouble for the industry. That's because insurer access to needed information for claims administration for medical portions of p-c coverages, such as workers comp and auto coverage, is obtained from entities now regulated by the new law.

"There are provisions designed to exempt the transmission of data needed to process workers' comp claims. Obviously, insurers need information on policyholders' health information. They need to find out if this is a new injury or a flare-up," said Keith Bateman, vice president of workers compensation and health for the Alliance of American Insurers in Downers Grove, Ill.

"Insurers need medical information if they are paying for the medical treatment under workers comp. And in the medical pay provision of an auto insurance policy, you want to be able to find out that the treatment is, in fact, related to the injury," Mr. Bateman said.

He expressed concern that under the new rules, covered entities are required to disclose only the "minimum necessary information," a wording that could hurt p-c insurers down the road. "That's where we run into a problem in workers comp. We don't know what that means–it's too vague," he said.

This could be a problem because many doctors tend to view "minimum necessary information" in terms of medical treatment, whereas for workers comp, insurers may need more data for legal purposes.

Mr. Pyles, the lead attorney for the lawsuit, argued, though, that the new law would end up giving insurance and drug companies more access to individual medical records without patients' permission.

"What we are finding is that many patients really object to that. This was not permitted before without their consent. But now it's permitted even when patients object," he said.

The plaintiffs include the Washington, D.C.-based Citizens for Health; American Association for Health Freedom in Great Falls, Va.; American Association of Practicing Psychiatrists in Kensington, Md.; St. Louis-based American Mental Health Alliance U.S.A.; American Psychoanalytic Association, based in New York; National Coalition of Mental Health Professionals and Consumers from Commack, N.Y.; and New Hampshire Citizens for Health Freedom in Keene, N.H.

Reproduced from National Underwriter Edition, April 28, 2003. Copyright 2003 by The National Underwriter Company in the serial publication. All rights reserved. Copyright in this article as an independent work may be held by the author.