The Federal Government Helps Again

Health care privacy and unintended consequences

My mother fell on ice and hurt her back this past February. Once she got out of the hospital, she decided to check herself into a nursing home for regular physical therapy to speed her recovery. After her admission to the nursing home, her health problems seemed to multiply. Her back pain was not subsiding as expected, and she began experiencing difficulty swallowing. Because of this latter problem she started to lose weight at an alarming pace.

So began an elaborate round of medical tests aimed at figuring out why her back still hurt and why she couldn't swallow. I live far away from my mother so I could not monitor her condition personally. When I would call to find out about her pains and what the latest test results were, she wasn't very good at describing them. Since she did not seem to be improving, I was becoming worried. Weary of my questions, my mother told me to call her primary care physician directly.

I'm sure he's a good doctor, but we had considerable difficulty connecting. Finally, very frustrated and thinking that one physician would respond with more alacrity to another physician, I asked my own doctor, in whom I have a great amount of trust, to call my mother's doctor. He's an old college roommate, and I selected him as my future physician after he nearly had a nervous breakdown over getting a B+ in a one-hour lab course, thus ruining his 4.0 average; in other words, he's a perfectionist. It was at the point when he called my mother's doctor that I ran up against the 369-page privacy regulations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which didn't take full effect until this April.

My mother's doctor informed my friend that because of HIPAA regulations, he could not disclose any information about my mother's treatment unless she signed some sort of consent form. Feeling as badly as she did and confined to a nursing home, my mother certainly did not want to deal with more forms. Of course, I understand my mother's doctor's perspective; he could get into a lot of trouble for violating the new regs. For example, according to the Department of Health and Human Services' Office for Civil Rights, "A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA faces a fine of $50,000 and up to one-year imprisonment." So why risk it? Besides I'm sure he's got problems enough coping with other federal health care requirements like the ever-growing thicket of Medicare rules.

It turns out that I am not alone in being frustrated by the new regs. The New York Times reported Tuesday about a woman who laid unconscious and dying in Maryland, yet the hospital would not tell her friends and relatives what room she was in, or even that she was a patient.

Of course, there have been some egregious violations of medical privacy, most commonly in granting employers access to employees' medical history. Nevertheless, the HIPAA privacy regulations are a good example of the unintended consequences when regulators try to codify what once were rough-and-ready commonsense rules. It's not as though physicians were big gossips in the first place. After all, for centuries, they swore the Hippocratic Oath, which commands: "Whatever, in connection with my professional practice or not, I see or hear, in the life of men, which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret." In the days before the HIPAA bureaucrats decided to help her, my mother would have had only to tell her physician when she saw him next that it was OK for him to let me know what was going on. Not now. Only "written authorization" will do.

Don't get me wrong. I'm all for privacy, especially medical privacy. And no doubt, times change, and technological advances like computerized records and the Internet mean that new precautions need to be taken to protect privacy. But maybe the powers that be at HIPAA could launch a new rule-making aimed at giving both patients and doctors greater flexibility about what information it is appropriate to disclose. That should only take another seven years to enact.

By the way, I still don't know exactly what was wrong with my mother, but I'm not going to worry about it too much since she's at home now and feeling much better.