APA has expressed concerns about a change the U.S. Department of Health and Human Services (DHHS) is proposing for the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. Psychology practitioners are watching this provision closely since they must comply with the law by next April 14, regardless of any changes the Bush administration adopts.

HIPAA was enacted by Congress in 1996 to set guidelines for protecting patients' records and privacy. Last year, DHHS finalized the federal rules to govern how records are handled within the health-care system. These HIPAA provisions, including the privacy rule, became effective under President Bush in April last year--though compliance wasn't expected until 2003. But this March Tommy G. Thompson, secretary of health and human services, suggested modifications favored by the health-care industry.

Of particular interest to APA, DHHS said that doctors and hospitals should not have to obtain generalized consent from patients at the start of treatment before using or disclosing medical information for treatment or reimbursement purposes--thus dropping the original consent requirement. The Bush administration believes that by giving notice to patients about how their records might be used and giving an opportunity to object--rather than obtaining written consent--privacy will still be protected. Thompson said the consent requirement could delay health care. For example, hospitals argued that medical procedures could not be scheduled until patients had signed a consent form.

In a letter to DHHS on April 26, Russ Newman, PhD, JD, APA's executive director for practice, voiced APA's stance on the modification.

This particular section of the privacy rule specifically gives patients the right to give or refuse consent for the use of their medical records for payment, treatment and health-care operations purposes. In effect, the patient has control over how his or her medical information may be used. Removing the requirement, said Newman, could shift "'ownership' of the record from the patient to the entities that use and disclose the record for treatment and administrative purposes."

APA believes the general consent requirement should remain in the final rule. But, it's important to note, says Newman, if the requirement is removed, "providers still have the same obligations" to inform patients of their privacy practices and the type of information that may be disclosed.

Regardless of the outcome of the general consent requirement, privacy is still protected by the rule's requirement that specific authorization must be obtained for disclosure of information for purposes other than treatment, payment or administrative activities. Specific patient authorization is also required for the use or disclosure of psychotherapy notes, commonly known as "process notes." During the initial rule-making process, APA successfully urged DHHS to include this provision.

APA also took the opportunity to urge DHHS to consider specific authorization for test data, saying that the psychotherapy notes provision should be accompanied by an additional patient authorization for the release of particularly sensitive psychological test data--including test results, raw test data, reports, global scores and test materials, such as manuals, scoring keys or algorithms.

APA also believes that some insurers' administrative functions don't directly relate to treatment, payment or operations, and that specific patient authorization should be obtained before identifiable information can be released for such activities. Some of these functions might include, for example, quality assessment and improvement activities, protocol or clinical guideline development, student training activities, and fraud abuse and detection programs.

In addition to pushing the department to consider specific patient authorization for testing and certain administrative functions, APA is keeping a close watch on the "minimum necessary" requirement--which has been the focus of recent debate. The requirement ensures that only the minimum amount of identifiable patient information necessary is disclosed for treatment, payment and health-care operations purposes. In the letter, APA urged the department to define "minimum necessary" in a way most favorable to patients. The APA Practice Organization intends to include in its HIPAA materials suggested procedures to enable psychologists to provide maximum protection for patients' health information and be in compliance with the "minimum necessary" requirement.

APA also joined with more than 30 other organizations, such as the National Association of Social Workers, the American Psychiatric Association and the National Alliance for the Mentally Ill, that make up the Mental Health Liaison Group, to sign similar comments to DHHS.

At Monitor press time, the Practice Organization expected that the rule issued by DHHS would be final this summer.

--J. DAW

Further Reading

The APA Practice Organization and the APA Insurance Trust are creating HIPAA compliance tools that will be available later this year.