New GAO report in the 1st year of the Amended Privacy Rule

Dear all,

The attached web address provides a link to a new GAO report in the first year implementation of the Amended Privacy Rule. The results show few surprises. Covered entities experienced little difficulty in implementing the rule except for finding it too burdensome to account for non-routine uses and disclosures and entering into business associate contracts. By contrast, consumers filed 5,648 complaints that their medical privacy was being violated under the Amended Rule. GAO felt that this reflected a lack of understanding by consumers since two-thirds of the complaints were for privacy violations that are permitted by the rule or fall outside of it. Of the one third of the complaints that fell under the rule, no violation was found to have occurred in about half.

The fact that approximately 6000 complaints were filed in the first year of the Amended Rule's operation is remarkable when one remembers that most of the uses and disclosures under the Amended Rule are permitted and authorized without notice to the patient, patient consent or an accounting.

Thus, the GAO report finds that, even though patients are not aware of most of the uses and disclosures of their health information under the Amended Privacy Rule, more than 470 complaints of medical privacy violations were filed per month (approximately 30 per day). Most of the alleged violations were found to be authorized by the Rule or not precluded by it. Of those that were covered by the Rule 50% were found to be valid (approximately 1000) in the first year. It is important to remember that medical privacy, once lost, is unlikely to ever be regained.

It is ironic that the GAO report would be issued the day after CNN aired a report noting that President Bush and Senator Kerry have both refused to consent to make their full medical records public. See "The First Patient: Health and the Presidency" (CNN October 3, 2004). That program cited a June 2004 CNN/Gallup poll that found that 61% of Americans believe that presidents should have the same rights as citizens to decide for themselves whether their health information should be disclosed. That program also included a statement from the White House physician during the Reagan years who stated, "The release of any information regarding the health or medical care of the President is, and must always be, the decision of the President himself." Of course, this right of self determination with respect to one's health information is precisely what was eliminated by the Amended Privacy Rule.

For more information, see the link below

http://www.gao.gov/cgi-bin/getrpt?GAO-04-965

Jim Pyles

		NCMHPC
National Coalition of Mental Health Professionals and Consumers, Inc.

an educational foundation and advocacy organization serving mental health consumers and professionals