Confidentiality and Access to Medical Records
NAMIís Position (Summarized from the NAMI Policy Platform)
NAMI acknowledges the dramatically changed environment of data linkage and integration and believes that national standards should be adopted for maintaining the privacy and confidentiality of individually identifiable medical records. National protections should serve as a floor, not a ceiling; states should be able to supplement and expand protections. The core principle of any standard is the concept of informed consent for the use or disclosure of individually identifiable health information. There should be strong and effective remedies for violations of standards.
A second core principle is that consumers (patients) of healthcare services own their own health records, while providers and health plans are custodians of these records. Consumers have a right to inspect and amend their own healthcare records. Treating providers are obliged to accept information from family members or others who function in a caregiving role. Treating providers should be responsible for making known to caring families and caregivers any information necessary to the ongoing care of persons with serious mental illness.
Why a Concern with Privacy of Medical Records?
Because of stigma and discrimination, treatment of mental illness has frequently been subsequently usedóparticularly by employers, insurance companies, and law enforcement officialsóto harm the life situations of persons with mental illness. Employers who self-insure for health care have frequently used health records to terminate from employment or otherwise put at a disadvantage persons with mental illness merely because they have received mental health treatment. Clearly, a wall must be built to protect patientsí health records from employers and law enforcement.
The issue is more complicated within the boundaries and confines of a health plan itself. Health plans are designed to coordinate and integrate care between treatment providers. Health plans benefit from sharing clinical information to avoid such mishaps as medication contraindications. In an age of managed care, health plans use clinical information to perform utilization review, to make payment decisions, and to promote consistency in best clinical practice. Determining at what point it is appropriate for the consumer/enrollee to say no to this sharing of clinical information within a health plan while continuing to expect the health plan to reimburse all provider claims is the central issue of controversy.
NAMIís Advocacy Strategies and Goals
- Patient consent is the governing principle.
- Consumers should be allowed to inspect and amend their health records.
- Clinical information should be shared with families and caregivers.
- States should be allowed to preempt the national standard with laws that are more protective of individual privacy rights.
- The refusal by a consumer/patient to consent to sharing of clinical information shall not be used to deny treatment, adversely affect services, or otherwise discriminate against persons with severe mental illnesses. A patientís refusal to consent to the sharing of clinical information may however be a factor in determining whether or not medical negligence exists for clinical harms resulting from the non-exchange or the inadequate exchange of clinical information between providers.
Provider Accountability, Health Plan Accountability, Services Research
Our society has the technical capability to mask individual identifiable information. It is fundamental to promoting accountability and to furthering services research that anonymous data be collected and analyzed. Masking technology can be used to protect personally identifiable information while promoting accountability and expanding services research.
Proposed Federal Medical Privacy Standards:
The Health Insurance Portability and Accountability Act of 1992 (HIPAA) mandated Congress to enact by August 21, 1999, a national standard governing access to medical records. If the Congress does not act, proposals made by the Secretary of Health and Human Services (HHS) in September 1997 will become the law of the land.
August 21, 1999 came and went, and Congress was unable to reach consensus on any of the medical privacy proposals before it. Thus responsibility for developing national medical privacy standards now falls on the Secretary of HHS. On October 29, 1999, Secretary Donna Shalala issued draft regulations. Comments on these regulations must be submitted by February 17, 2000.
The draft HHS regulations are complex and multifaceted.
Treatment providers and health plans would be allowed to disclose a patientís protected health information (PHI) without authorization for purposes of treatment, payment, and health care operations related to payment (such as quality assessment; performance review; training programs; licensing and audits). However, separate voluntary authorization would be required for the use and disclosure of psychotherapy notes. Allowing disclosure of PHI for purposes of treatment, payment and health care operations is inconsistent with NAMIís policy, which incorporate informed consent as a cornerstone.
Individuals would have the right to see and copy their own health information, except when such access would endanger the life or safety of any individual. (This is a far narrower exception than currently exists in most states laws, where treatment providers or health plans have broad discretion to deny access to individual health records). Allowing consumers to see and copy their own health information is consistent with NAMIís policy.
The draft HHS regulations would permit treatment providers or health plans to disclose protected health information to family members if the individual has agreed to such disclosure or when such agreement canot be practicably or reasonably obtained. Only information directly relevant to the family memberís involvement in the individualís health care may be disclosed. This is consistent with NAMIís policy, which states that treatment providers are responsible for making known to caring families and caregivers any information necessary to the ongoing care of persons with serious mental illnesses.
The draft HHS regulations serve as a baseline of minimum privacy protections, and allow states to maintain and enact laws that are more protective of individual privacy rights. This is consistent with NAMIís policy, which specifies that states should be allowed to preempt the national standard with laws that are more protective of individual privacy rights.
The draft HHS regulations would prohibit treatment providers or health plans from denying treatment, enrollment in a health plan or payment of a claim if he or she refuses to authorize disclosure of psychotherapy notes. While this appears consistent with NAMIís policy, the issue of conditioning care upon the provision of consent is largely irrelevant in the context of the HHS regulations because they would not require consent for purposes of treatment, payment and health care operations.
For more information about NAMIís activities on this issue, please call Ron Honberg at 703/516-7972. All media representatives, please call NAMIís communications staff at 703/516-7963.