National Committee on Vital & Health Statistics

March 2, 1999

George M. Reider, Jr.
President, NAIC
National Association of Insurance Commissioners
P.O. Box 816
Hartford, CT 06142

Dear Mr. Reider:

The National Committee on Vital and Health Statistics (NCVHS) appreciated the informative briefing on the Health Information Privacy Model Act (Model Act) provided by Wendy Pellow, Legislative Counsel, Federal Health Affairs, and Jennifer Cook, Counsel for Health Policy, of the National Association of Insurance Commissioners (NAIC) on November 12, 1998 to the Subcommittee on Privacy and Confidentiality. The NCVHS commends the NAIC on its interest in the privacy and confidentiality of health information.

Over the past two years, the NCVHS has held several hearings on health information privacy issues. The Committee heard testimony from a broad spectrum of experts in the field including representatives from industry, research and public health, and the privacy community. The Model Act was reviewed in light of this testimony, the NCVHS’ recommendations to the Secretary of Health and Human Services, and the Secretary’s subsequent recommendations to the Congress in September of 1997 concerning federal legislation to protect the privacy of health information. The NCVHS would like to call to your attention some of our major concerns regarding the Model Act.

Redisclosure of Protected Health Information

The NCVHS is very concerned about the redisclosure of protected health information to individuals and organizations who are not bound by the ethical and legal obligations to maintain the confidentiality of health care information and to use it appropriately.

Section 10 E (2) of the Act allows a carrier to disclose protected health information to an individual’s employer, including the employer’s designated risk manager, without authorization, if the information is disclosed pursuant to the employer’s administration of a health and welfare benefit plan.

The Secretary has recommended that, with very few exceptions, health care information about a consumer should only be disclosed for health purposes. The recommendations specifically statethat employers should not be able to use information obtained for health care purposes to make decisions about job hiring, placements, and promotions.

This principle is reflected in section 10 J of the Act, which states that a person who receives protected health information from a carrier, shall only use it for the lawful purpose for which it was disclosed. Nevertheless, employers are not bound by this Act, and there are no restrictions on the use of the information that they receive. Americans are legitimately concerned that employment decisions will be based on protected health information.

Americans are also concerned that decisions about health insurance coverage will be based on protected health information. Section 11 A (3)(a)(2) of the Act allows the disclosure of protected health information to or from an insurance support organization provided that the information is used to perform certain insurance functions including the prevention of fraud.

The NCVHS notes that this provision would allow all health claims that are filed subject to this Act to be disclosed without authorization to the Medical Information Bureau (MIB) for the purpose of detecting fraud. The NCVHS does not support this type of unauthorized disclosure because this provision would vastly increase the ability of the MIB to track information on people who have never applied for underwritten life or health insurance.

Research and the use of Non Identifiable Information

Section 12 A states that a carrier may disclose protected health information without authorization to research organizations conducting scientific, medical or public policy research as provided in the Act. The Act does not require the use of an Institutional Review Board (IRB) as recommended by the Secretary.

The Secretary’s recommendations recognize the importance of research to improve the health of all citizens, and acknowledge that there are situations under which protected health information should be made available to researchers without consent. The recommendations state that the conditions for such disclosure should include a determination by an IRB that the research involves minimal risks to participants, that the absence of consent will not adversely affect the rights or welfare of participants; and that conducting the research would be impracticable if consent were required.

The NCVHS strongly supports the Secretary’s recommendations regarding research. It is the view of the NCVHS that the requirement of an IRB in the Act will limit further disclosure of protected health information and provide greater protection against the use of personally identifiable protected health information for marketing or unscrupulous purposes.

It is also important to note that the Act does not require the dis-identification of data or suggest the use of aggregate data whenever possible. The NCVHS recommends that the Act be revised to support the use of non-identifiable data whenever possible.

Thank you for the opportunity to provide comments on the Health Information Privacy Model Act. The NCVHS has several additional concerns that we would like to discuss with you, and we would be happy to answer any questions that you may have. Kathleen A. Frawley, JD, MS, RRA, Chair, Subcommittee on Privacy and Confidentiality, will contact you to discuss these concerns, or you may reach her at 202-218-3535.

Sincerely,

/s/

Don E. Detmer, M. D.
Chair

cc: State Insurance Commissioners
Wendy Pellow
Jennifer Cook
Cathy Weatherford
Kevin Cronin