Galen Institute Responds to Medical Records Privacy Regulations

U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation

Dear Assistant Secretary:

I am writing to express my opposition to the Department of Health and Human Services’ proposed medical privacy regulations, which were published in the Federal Register on November 3, 1999.

Certainly, as Congress recognized when it passed the Health Insurance Portability and Accountability Act in 1996 that addressed the issue of medical record confidentiality, protecting the privacy of Americans’ medical records is a top priority.

But the rules that have been proposed by DHHS would, in fact, expose citizens to invasions of their medical privacy without their knowledge and provide the framework for creation of a federal medical database containing the medical records of every American. As we learned from the recent hacking of sophisticated Internet sites, once the information is collected, someone will find a way, legally or illegally, to access it.

As we enter the information age, the collection and security of medical record will become both more and more important and more and more difficult. The problem must be addressed from two fronts: 

  • First, by changing the financing system that not only invites but virtually requires third parties to collect information on the medical experiences of patients.
  • Second, by not rushing into a misguided, hastily conceived set of regulations that invite abuse and misuse.

Reform Financing System

The current structure of third-party payment for medical bills in the United States invites both public and private sector payors to access the medical records of citizens.

For the 160 million Americans who have some form of health insurance coverage through the workplace, that means that employers have the right to look at the medical experiences and the bills that are being submitted for payment on behalf of employees.

For those receiving health services through publicly-funded plans such as Medicare and Medicaid, recipients’ bills are also submitted for payment and detailed records are required by government on the patient’s illnesses and treatments received.

Worse, Medicare’s rules are so strict that even if a patient wishes to go outside the system to receive medical care under a private contract with his or her physician, the doctors must agree to forgo all other Medicare patients for two years in order to accede to the patient’s wishes. Medicare’s prohibition on private contracting between a physician and a patient is a clear violation of the rights of the patient to receive the care he or she may need from their physician of choice. This is a clear indication that the more government gets involved in directing the medical treatment of patients, the more invasions of rights and privacy we will see.

The solution to both publicly and privately-financed health insurance coverage is to return power and control over decision-making to patients and away from bureaucracies. With employment-based health coverage, that means allowing employees to receive that part of their compensation that currently is being spent by their employers on their health coverage and to select a health plan that they choose. That also means equalizing the tax laws so that individuals who purchase health insurance or other forms of coverage on their own receive the same tax favored treatment as those whose employers currently purchase it for them.

Medicare and Medicaid could be reformed to give recipients a defined contribution equal to the amount that currently is being spent on their medical benefits so that they can purchase private coverage. Senators John Breaux, Bill Frist, and John Kerrey have introduced legislation in the Senate that provides the framework for such a transfer of money and power to the individual and away from centralized government bureaucracies.

Once individuals are in control of the dollars that are being spent on their health care, they will be better able to make health care arrangements that suit their needs, both for medical treatment and for protection of their privacy.

Withdraw Regulations

The current medical privacy regulations as proposed should be withdrawn. There are huge loopholes that invite massive invasions of patient privacy.

A quote from the fact sheet put out by the DHHS describes all too clearly the potential for abuse:

“After balancing privacy and other social values, HHS is proposing rules that would permit disclosure of health information without individual authorization for the following national priority activities and for activities that allow the health care system to operate more smoothly:

  • Oversight of the health care system, including quality assurance activities 
  • Public health 
  • Research 
  • Judicial and administrative proceedings 
  • Law enforcement 
  • Emergency circumstances 
  • To provide information to next-of-kin 
  • For identification of the body of a deceased person, or the cause of death 
  • As authorized for governmental health data systems
    For facility patient directories 
  • By banks and other financial institutions, to process health care payments and premiums 
  • For activities related to national defense and security

“BOUNDARIES. With few exceptions, an individual’s health care information would be used for health purposes only?”

Individuals, companies, and agencies will find a way to drive a tank through these loopholes. Protecting individual privacy of medical records is essential. Collecting information and disseminating it for a long list of purposes, without individual authorization, clearly fails that test.

It is imperative that these rules be withdrawn and that Congress assume the responsibility that it has transferred to the DHHS so that any new rules that are developed can genuinely protect patient privacy and that these rules can be fully vetted and understood by the electorate through a public debate.


Grace-Marie Arnett
Galen Institute
P.O. Box 19080
Alexandria, VA 22320
(703) 299-8900


About the author