NursingWorld | ANA Testimony: 2001: Assessing HIPAA: How Federal Medical Record Privacy Regulations Can Be Improved

Testimony of the American Nurses Association
on Assessing HIPAA: How Federal Medical Record Privacy Regulations Can Be Improved
before the Energy and Commerce Subcommittee on Health
United States House of Representatives
March 22, 2001
Presented By
Mary E. Foley, MS, RN
President, American Nurses Association

I am Mary Foley, President of the American Nurses Association, which is the only full-service professional organization representing the nation's registered nurses through our 53 state and territorial nurses associations. It is a pleasure to be here this morning to offer our views on the patient privacy and confidentiality regulations issued by the Department of Health and Human Services in December of last year.

Mr. Chairman, I am a health care practitioner. Until I became President of the American Nurses Association just over a year ago, I was a nurse executive in a medium-sized hospital in California. Before that, I spent seventeen years as a staff nurse, and I have served as clinical instructor in nursing.

The second charge in the Code for Nurses states, "The nurse safeguards the client's right to privacy by judiciously protecting information of a confidential nature." That simple statement is an obligation the nursing profession takes very seriously.

Virtually all of ANA's members are involved in creating, transmitting, maintaining, and safeguarding patient records on a daily basis as an integral part of their professional practice. Working on the front line of health care, registered nurses are well aware of the concerns of their patients regarding privacy and confidentiality and are professionally committed to strong enforceable standards to protect the confidentiality of the health information of their patients.

This commitment has always been a part of professional practice. But the need for Federal law is in large part a function of the momentous change in communications technology. Health care professionals have always been aware of the importance of confidentiality and the possibilities for carelessness; the need for that reminder in the code of ethics is real. But the complexity of the health care system means that transgressions of patient confidentiality, intentional or not, have much broader consequences than ever before, because the information travels further and faster and cannot be retrieved.

In my testimony, I will focus on two aspects of this issue that I can speak to as a nurse and as a representative of the nursing profession: First, is the necessity to keep our focus on what is best for the patient. Second, is the practical application of this standard in health care settings.

The most important test that these regulations must meet is whether every individual patient's reasonable expectations for privacy and confidentiality are addressed. Can I assure my patients that – when they are describing the most intimate, troublesome, embarrassing, frightening aspects of their lives to people who will treat them and care for them – there will be safeguards for maintaining the confidentiality of this sensitive information?

Mr. Chairman, if I can't do that, many of my patients will go without treatment or will disclose only some of the information, a dangerous proposition, which can lead to improper diagnosis, improper treatment, complications in an illness or injury, even death. It is hard to talk about a whole range of sensitive issues, which might include mental illness, sexual practices, and physical abuse. And it will not happen at all if you think your story is going to be grist for the local gossip mill or sold to a corporation that will farm it out to telemarketers in case you might be in the market for a pregnancy test or be available to your employer, who will have then the opportunity to consider the implications of a prescription for antidepressants.

This concern for our patients must be our overriding concern, not whether the rule will be inconvenient for hospitals or practitioners or staffers who handle insurance paper work.

This regulation requires that "a covered entity must reasonably safeguard protected health information from any intentional or unintentional use or disclosure....." Of course it must. Accrediting bodies for hospitals already require it. Any suggestion that this is a new or burdensome requirement for health care institutions is really unfounded. Watch your voice, don't talk about patients by name in the hallways, post prominent notices for patients informing them that staff will work to meet their requests for great privacy - and do it. These instructions are the stuff of daily work in a hospital setting. Every nurse is trained to be attuned to its importance. And any hospital or practitioner that isn't already doing it - and doing it seriously - is a menace.

The American Nurses Association has long been in the forefront of organizations that have worked for better and more standardized electronic communications among health care providers as an important improvement in patient treatment and care. It is clear that the work in this area undertaken as a result of the Health Insurance Portability and Accountability Act will provide a huge cost benefit to plans and providers, as well. For the health care industry to accept this financial boon and then attempt, as is apparent in recent weeks, to weaken or impede these important safeguards to patient privacy and confidentiality is unfortunate and counterproductive.

We believe that this rule should go forward as issued. Congress ordered the Department of Health and Human Services to develop and promulgate this standard, absent Congressional action in the three years following enactment of the Health Insurance Portability and Accountability Act. The Department issued the standard as directed, after having sought and worked through an immense number of comments from a full range of stakeholders in the process. It is certainly remarkable to hear that some stakeholders believe that they have not been afforded a full opportunity to be heard. As would be expected, changes were made in the proposed rule in response to comments. The Department was careful to point out in its request for comments areas in which more information was wanted, such as the approach on requirements for patient consent. No final rule can ever be issued if it is always subject to additional comment. It is clear from a decade of Congressional attempts to fashion legislation on this issue that not all stakeholders will agree on some aspects of the issue, but the paramount concern must be the continuing and growing need for the regulation.

Are there issues that ANA considers important for future regulatory or legislative action? Yes. There is still inadequate protection for occupational health nurses who are daily pressured by their employers for access to information about employees who are treated at the work place. There is still no private right of action for individuals whose identifiable health information is recklessly disclosed. There is still inadequate protection from the use of private information for marketing purposes - the essence of privacy is the right to be left alone. There are still inadequate restraints on law enforcement access to information.

But these issues - and issues that may trouble other providers, consumers, or covered entities - may be dealt with in the future through legislation or regulation. Congress wisely in 1996 recognized that a legislative remedy could be difficult to achieve and wisely recognized that health privacy and confidentiality are far too important to be left subject to the vagaries of a difficult legislative environment.

We come back to our original point: for nurses, the first issue is protecting our patients. The regulation as issued is too important to be delayed or rescinded. There is time, if efforts are made in good faith, for covered entities to comply with this regulation. And there are administrative and - of course, ultimately - legislative remedies available for any aspect of the rule that should prove to be unworkable.

In the meantime, every day there are practitioners who, as a matter of ethics and successful treatment, must be able to assure their patients that their records are protected. We have a patchwork of state laws that provide some protections to some people some of the time in some places. We need this national standard of basic protections for all of our people all of the time in every place in the nation.