June 17, 2004
The Honorable Tommy G. Thompson
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Dear Secretary Thompson:
As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Committee on Vital and Health Statistics (NCVHS) monitors the implementation of the Administrative Simplification provisions of HIPAA, including the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule).
The NCVHS Subcommittee on Privacy and Confidentiality held hearings in Washington, DC on February 18-19, 2004. The hearings, the second of several to be held on HIPAA implementation, were intended to gather information about the effect of the Privacy Rule in three areas: banking, law enforcement, and schools. Additional hearings will address other aspects of HIPAA implementation. This letter conveys the Committee’s findings and recommendation for action by the Department regarding law enforcement. Separate letters contain findings and recommendations regarding banking, and schools.
Four witnesses testified about the effect of the Privacy Rule on law enforcement, including representatives of the National District Attorneys Association, the Office of Diversion Control of the U.S. Department of Justice’s Drug Enforcement Administration (DEA), the American Civil Liberties Union, as well as a privacy and information policy consultant.
The witness from the DEA’s Office of Diversion Control testified that his office is responsible for preventing the diversion of controlled pharmaceuticals for illicit purposes. Controlled pharmaceuticals include narcotics, depressants, and stimulants manufactured for legitimate medical use. Examples of diversion cases are physicians who sell prescriptions to drug dealers or abusers, and pharmacists who falsify records and subsequently sell the drugs. Under Federal law, all businesses that manufacture or distribute controlled substances, all health professionals entitled to dispense, administer or prescribe them, and all pharmacies entitled to fill prescriptions must register with the DEA. Registrants must comply with a series of regulatory requirements relating to drug security, records accountability, and adherence to standards.
The DEA witness indicated that he believed that the HIPAA Privacy Rule has had the effect of limiting the provision of information to DEA diversion investigators by professionals subject to controlled substances laws. Some physicians and pharmacists who were suspicious about potential drug abuse by patients have expressed reluctance to share their suspicions with the DEA because they have misinterpreted the HIPAA Privacy Rule as preventing such communications. Also, some States have prescription-monitoring programs, which are programs supported by the DEA. Some entities covered by these State programs are reluctant to comply with reporting requirements because they have misinterpreted the HIPAA Privacy Rule as preventing such communications. Overall, the DEA witness testified that more education and outreach about the HIPAA Privacy Rule are needed to overcome these misinterpretations about the Rule.
Members of the public present at the hearing were given an opportunity to comment about the HIPAA Privacy Rule. A representative of the Association of American Physicians and Surgeons (AAPS) expressed concern about the adverse effect the Privacy Rule has had on the practice of medicine in the area of pain management. According to the AAPS, some physicians have chosen to stop prescribing controlled substances because they are concerned that the documentation they place in their patients’ medical records will not be kept confidential due to disclosures permitted by the HIPAA Privacy Rule. The same physicians also are concerned about prosecution or suspicion of wrongdoing if they omit from medical records that their patients are receiving prescribed controlled substances.
The American Civil Liberties Union (ACLU) testimony described several concerns about the HIPAA Privacy Rule’s provisions for law-enforcement disclosures without patient consent. The ACLU is concerned about the Privacy Rule’s lack of a requirement for judicial review for an administrative subpoena, summons, or civil investigative demand. Under the HIPAA Privacy Rule, law enforcement agents may issue written demands to doctors, hospitals and insurance companies to obtain patient records. The ACLU believes that government agents should be required to obtain judicial approval under a probable cause standard before having access to patient medical records held by a physician or an insurance company.
The ACLU also expressed concern that the Privacy Rule does not require that the individual whose records are about to be disclosed receive notice of the impending disclosure and an opportunity to contest the disclosure. The ACLU suggested that if there were any risk that notice to the individual would lead to destruction of the records, waiver of the notice requirement could be permitted.
NCVHS believes it did not hear testimony from a sufficiently broad range of witnesses about the effect of the Privacy Rule on law enforcement and thus must limit its recommendation to drug diversion activities. Based upon the oral and written testimony presented at the hearing, NCVHS recommends that HHS work with the DEA to educate providers that communicating information about drug diversion or complying with State reporting requirements are permissible under the HIPAA Privacy Rule.
We appreciate the opportunity to offer these comments and recommendation.
Sincerely,
/s/
John R. Lumpkin, M.D., M.P.H.
Chairman, National Committee on Vital and Health Statistics
Cc: HHS Data Council Co-Chairs