The focus of health care privacy in 2007 will be on new enforcement issues, new opportunities and challenges related to the use of health care information. We also expect a renewed and continuing debate on whether new legislation is needed to address changes to the health care privacy environment.
Because of these developments, health care privacy clearly will be an important issue in the year ahead, not only for entities subject to the Health Insurance Portability and Accountability Act (HIPAA) rules, but also for the wide range of employers, vendors and others who are using health care information in new ways or pursuing new business opportunities tied to health care information or health care technology.
The HIPAA Enforcement Picture
Is this the year that HIPAA enforcement will become active? We may be seeing a perfect storm of pressures that will force enforcement action.
First, the political changes on Capitol Hill make clear that the current privacy enforcement structure will face intense scrutiny. Democratic lawmakers already have promised hearings and investigations into what the government is doing on enforcement, particularly for health care entities.
Second, we are starting to see other entities—beyond HHS—getting into the enforcement picture for health care entities. For example, when Humana confronted two separate security breaches, it found itself facing charges from the North Dakota Insurance Commissioner, mandating credit monitoring services and payment of $50,000, to offset costs and expenses incurred by the department during its investigation.
In another case, unencrypted backup tapes and discs containing personal information on 365,000 patients of the Providence Health System were stolen from an employee's car. The Providence Health System reached a settlement recently with the Oregon Attorney General (who relied on the state Unlawful Trade Practices Act) requiring Providence to provide credit monitoring and credit restoration services, as well as enhance its security program.
Obviously, such state agencies are not the primary regulator of privacy and security practices for the health care industry. For example, in both the Humana and Providence situations above, one would think that the Department of Health and Human Services, either through the Office of Civil Rights (privacy) or the Centers for Medicare and Medicaid Services (security), would have been the relevant regulator for a security breach. Nonetheless, in 2007 and beyond, these "other" regulators may well be the main enforcers that companies have to worry about in the event of privacy or security problems. Their initiatives may, in turn, create pressure on HHS to take a more aggressive approach to privacy and security enforcement.
In addition, we have seen some signs that HHS will step up its enforcement efforts. Certainly, the agency's approach to date—particularly when the HIPAA Privacy Rule first went into effect—has been helpful in ensuring that appropriate information flow was not impeded. Moreover, despite the adverse publicity about HHS' lack of enforcement, many of the complaints that HHS has investigated have concerned (1) non-covered entities; (2) minor errors; or (3) no rule violation at all. So, the critics who highlight the large numbers of complaints without enforcement action may implicitly overstate the volume of actual privacy violations.
With all of that said, however, we predict that 2007 will see more enforcement of privacy and security obligations involving the health care industry, from both HHS and other regulators.
New Uses of Health Care Information
Health care privacy also has been in the news recently, based on numerous developments affecting the use, disclosure and distribution of health care information. Several interrelated trends drive this complex problem. First, employer involvement in the management of their health care expenditures is on the rise. They are exploring new benefit options, designed to reduce overall expenditures and improve employee health. This has led to the need for more information, to evaluate how these new options are working. At the same time, employers (and many others) are interested in "wellness" activities—encouraging, incentivizing and even forcing employees into programs designed to improve overall health. Data clearly is needed to support these activities, if they are to be effective.
At the same time, medical research is expanding—and more research needs more data. Also, as medical research reaches further into the details of people's health, this information can be used in more and more ways—some seen as good, some bad, depending on one's perspective. So, the sensitivity of uses of medical data is increasing. Gaps in the HIPAA rules, and the increasing prominence of various international actors in the field of medical research, complicate an already complex regulatory structure.
In addition, the push towards electronic medical records and personal health records raises a wide variety of new and old issues. This movement aims to improve medical outcomes and decrease administrative costs in the health care industry. Achieving these goals requires appropriate privacy practices that maximize information availability while, at the same time, protecting patient privacy and assuring patients that their personal information is protected. This is an enormous challenge, one that involves analysis of existing laws, identification of current best practices, and a significant new debate about the appropriate means of protecting patient privacy. (Full disclosure—I co-chair a working group at the Department of Health and Human Services that is tasked with developing many of these practices).
As this debate continues, the marketplace is moving ahead. Several large employers recently announced a new program to create personal health records for thousands of employees across the country. Almost simultaneously, two leading health insurance groups announced a joint program to develop compatible medical records for use by their customers. So, the health care industry—already at the forefront of privacy and security regulation—now is at the forefront of altering perceptions of how medical information should be used, prompting a new debate about the use and disclosure of medical information.
The electronic health records push and the encouragement of health care technology clearly are invigorating this debate about new uses of health care information. Key questions for this environment include:
- What are the reasons for pushing a national health care information infrastructure?
- How do these new environments, particularly the creation of Regional Health Information Organizations (RHIOs) fit into the existing HIPAA structure?
- Are new rules needed for this environment—that will be driving our evaluation of how best to incorporate privacy and security principles into this new electronic environment?
These issues are being actively debated but few areas of clear consensus have emerged. Nevertheless, the business of health care technology is moving quickly, before the regulatory structure is defined. We may learn in 2007 whether the regulatory structure can catch up, or whether the relevant regulatory environment is so far behind that the marketplace will set most of the rules.
Renewed Policy Debate on Privacy Legislation
These new uses and the political changes on Capitol Hill also highlight a specific new question:
- Are new privacy rules needed for the health care industry? This debate addresses several key questions: Are the HIPAA Rules working effectively?
- Does this new electronic technology environment require "something different" (e.g., new kinds of patient consent, increased security obligations, etc.)?
- Do changes in the relevant players in a new technology environment mean that the HIPAA rules, even if appropriate for mainstream health care entities, do not work effectively for the non-covered entities and business associates who play a more prominent role in the health information networks?
As the uses of medical information change, will there need to be a new "overall" health care privacy law, one that protects health care information regardless of whether it is held by or created for a HIPAA-covered entity? These issues are taking on increased visibility due to business developments and political change. They likely will be a focus of intense debate in 2007 and beyond. Any entity that uses, creates, discloses or maintains health care information needs to pay close attention to these developments.
Health care privacy—as a compliance issue—has been relatively quiet for a year or two. Now, companies are exploring new uses and disclosures of health care information, grumblings about enforcement are increasing, and we are seeing an expanding recognition of the limitations of the HIPAA rules as an effective approach to protecting overall health care privacy. So, we can anticipate an exciting year in the world of health care privacy in 2007.