HIPAA privacy regs take effect today

Sunday, April 13, 2003

April 14, 2003

WASINGTON - The Health Insurance Portability and Accountability Act (HIPAA) privacy rule, which guarantees a patient’s medical privacy, takes effect today.

The privacy rule applies to electronic but not paper medical records and allows providers to share the records for the purposes of treatment and other "health care operations."

Under the regulation, providers must obtain consent from patients before they can disclose medical records in "nonroutine" cases. However, providers do not have to obtain written consent before they disclose medical records. Providers only have to inform patients of their new rights and make a "good faith effort" to obtain written acknowledgment from patients that they have received the information.

That bothers some patient and privacy advocacy groups who last week filed a lawsuit that seeks to block the HIPAA privacy rule, the Philadelphia Inquirer reported.

The lawsuit, filed in a U.S. District Court in Philadelphia, asks the court to invalidate provisions in the rule that would allow health plans and associated businesses to share patient medical records without patient consent.

Jim Pyles, an attorney for the plaintiffs, said the rule would allow health plans and associated businesses to access information about family members, marital problems and reproductive health issues "without an individual's consent."

Craig Palosky, spokesperson for HHS, said that the department has not reviewed the lawsuit.