GOVERNMENT and LAW

Bush proposes to ease HIPAA privacy regs

The Bush Administration has fast-tracked a proposal to modify the patient privacy regulations of the Health Insurance Portability and Accountability Act (HIPAA), making it easier for pharmacists to dispense prescriptions without first getting the patient's consent to share information.

Subject to only a 30-day comment period, instead of the usual 90 days, the proposed HIPAA changes remove most of the earlier consent requirements governing the use or release of protected patient information for treatment, payment, or healthcare operations. Instead, pharmacists would have to inform patients about the pharmacy's privacy practices and make a good faith effort to get written acknowledgment from the patient that the notice had been received. But the acknowledgment does not have to occur before the information can be used to provide services.

Elimination of the patient prior consent requirement is good news for pharmacy. Many leaders had warned that the original rule would interfere with dispensing medications, especially with phoned in or transferred scripts, or when someone other than the patient came to pick up the Rx.

The proposed changes got a thumbs-up from the American Pharmaceutical Association as a step forward in striking a balance between privacy protections and access to health care, according to John Gans, Pharm.D., APhA executive v.p. He praised the Administration for responding to concerns from pharmacists, other healthcare providers, and patients.

Noting that the original consent provision was unworkable, Gans said, "The modifications will accelerate patient access to treatment and will continue to provide patients with strong privacy protection, while removing unintended barriers to healthcare services and reducing the administrative and financial burdens on providers."

The proposed HIPAA modifications also drew praise from Craig Fuller, CEO, National Association of Chain Drug Stores. "Once again, efforts to bring reason to public policy have prevailed," he said in written comments. Noting that NACDS and other pharmacy groups worked with Health & Human Services officials to smooth out trouble spots, he added, "We are very pleased that much of what we suggested is now contained in the proposal."

Fuller noted that under the proposal, patient healthcare services, refill reminders, and disease management programs are not considered to be marketing activities, regardless of who pays for the communication. And a pharmacy that buys Rx files can use the previous owner's patient records without restriction.

Pharmacists and other healthcare providers should take the requirement to obtain patient acknowledgment of privacy policy seriously, said Jeanne Scott, director of government relations, NDCHealth. Speaking at the recent annual meeting of the National Council for Prescription Drug Programs (NCPDP), she added, "You still have to give the patient notice of your privacy procedures and rules. Patients do have the right to repeal their authorization at any time. There is still record-keeping. I can't say whether you'll still have to maintain the acknowledgment for six years, but the answer is probably Yes."

The Bush proposal would still require that the use and release of information be restricted to only the minimum necessary to accomplish the intended purpose. It would also retain the oral communication requirement, but incidental disclosures, such as another patient overhearing part of a conversation, would not violate the rule. However, pharmacies should still take reasonable steps to isolate as much as possible conversations between a pharmacist and the person picking up the script, according to Scott.

Healthcare insurers and providers may have won this round, but the battle over patient privacy may soon shift to the states. Since HIPAA stipulates that the federal privacy regulation does not supersede more stringent state regulations, privacy advocates will likely focus their efforts on state capitals, predicted NDC's Scott. If some states have more restrictive state regulations, it would be bad news for drugstore chains that operate across state borders, she added.

Following the April 26 deadline for comments, HHS will review the comments and issue a final rule. The privacy rule implementation deadline remains April 14, 2003. Enforcement will be the responsibility of the federal Office of Civil Rights, which can impose significant civil and criminal penalties, including a $250,000 fine and 10 years in jail for the most serious violations.

Carol Ukens

Carol Ukens. Bush proposes to ease HIPAA privacy regs.

Drug Topics

2002;8:72.