Industry Groups Skeptical About New Privacy Rule

"However, a more precise rule is needed to state that health professionals may not restrict access to personal health information that a health plan determines is minimally necessary to fulfill its health care operations and quality assurance responsibilities," Klein says.

HHS Secretary Tommy G. Thompson says the revised rule is intended to safeguard patient privacy while correcting unintended consequences of the original rule that threatened access to quality care.

Much of the controversy surrounded the minimum necessary rule, which states that providers covered by the rule must limit the disclosure of personal health information to the "minimum necessary" to accomplish certain legitimate purposes, such as filing claims.

Insurance groups say this standard is so imprecise that it could make it difficult for insurers to obtain information needed to perform legitimate functions.

However, the revised rule addresses the minimum standard language only slightly. The new standard applies only to oral communications among providers and says providers need only take "reasonable safeguards" when discussing personal health information.

If so, the new standard says, then incidental disclosures, such as another patient hearing a snippet of conversation, would not be subject to penalties.

As for marketing, the new standard explicitly requires health plans to obtain specific authorization from an individual before sending any marketing material.

The privacy rule was mandated by the Health Insurance Portability and Accountability Act of 1996. Unless it is revised again, health plans and other covered entities will have to comply with the rule by April 14, 2003.