Doctors Mount First Legal Challenges to Privacy Rules
Privacy Experts Doubt Constitutional Arguments Will Succeed
By Sean Martin
WebMD Washington Correspondent
Reviewed by Dominique S. Walton, MD, MBA
Aug. 8, 2001 (Washington) -- National medical privacy rules aren't supposed to be in effect until April 2003, but several doctor groups are already taking the government to court in the first legal challenges to the new standards.
In one suit just filed, and another that is expected any day, physicians are trying to derail the rules, claiming that they are unconstitutional.
Many doctors believe the rules are well intentioned but will impose yet more bureaucratic burdens and costs on their practices.
The South Carolina Medical Association, along with the Louisiana State Medical Society, sued the U.S. Department of Health and Human Services (HHS) on July 16 in federal district court.
"This is another example of the federal bureaucracy gone awry and leaping far beyond the boundaries of common sense and, in this case, the law," says Dudley Stewart Jr., MD, president of the Louisiana society.
A 1996 health law granted HHS the authority to write privacy rules if Congress itself failed to act. Congress subsequently failed to pass any rules, prompting HHS to do the task itself through a formal, public rulemaking procedure. But the suit says that granting HHS this power was a violation of the separation of powers, since it delegated lawmaking authority to the health agency.
The suit faces tough odds, according to several privacy experts contacted by WebMD. As far as the delegation-of-authority argument, health privacy consultant Robert Gellman tells WebMD, "That is a total loser. This is a throwback to litigation from the 1930s. It barely passes the laugh test."
It was 1935 when the U.S. Supreme Court last found that an agency had acted unconstitutionally regarding delegated authority.
Joy Pritts, senior counsel for Georgetown University's Health Privacy Project, tells WebMD, "They have a very tough battle ahead of them. Precedent is not on their side. That will be very hard to overturn." But she adds, "Having said that, you never know."
The South Carolina suit also claims that the privacy rules are too broad, because they cover paper and electronic medical records, even though the 1996 law only gave the agency explicit authority to set standards for electronic medical information.
But the doctors may regret it if they succeed on this count, says Gellman, since that might mean that two different rules would apply to the same medical record in two formats.
In another signal of the suit's slim chances, the American Medical Association has declined to sign on. In a trustee report on the issue, the AMA concludes, "Such a challenge would be extremely difficult to win."
The health privacy rules give patients the right to access, copy, and correct their medical records. They also require that patients be allowed access information on how their information is going to be used by health providers.
Moreover, the rules require that health providers obtain written permission from patients in order to use individual medical records for a variety of purposes. Providers are also required to establish privacy-protecting policies and procedures, and those that violate the standards are subject to civil and criminal penalties.
Meanwhile, the Association of American Physicians and Surgeons (AAPS) says that it is also about to sue HHS on the privacy rules. During the Clinton administration, AAPS successfully sued Hillary Clinton's healthcare task force for violating public access rules.
The AAPS says the rules violate the Fourth Amendment, by giving the government access to personal medical records without a warrant. The group also claims that the rules are unconstitutional in covering "purely intrastate" doctor actions in using and maintaining medical records for patients.
But on the government access question, Gellman says, "We've been allowing that for 40 years for researchers, public health authorities, and fraud and abuse investigators. There is nothing new ... that authorizes new disclosures without a warrant."
Pritts agrees that HHS already has access to hundreds of thousands of Medicare and Medicaid medical records. "It's surprising to me that people are reacting so strongly to the government access provision, when they have already given up the ballgame," she tells WebMD.
Gellman and Pritts are also dubious of the doctors' argument that keeping medical records is a purely intrastate action, arguing that most health information crosses state lines for purposes such as insurance payment or drug prescribing.
Meanwhile, the Bush administration says it is fine-tuning the privacy rules to ensure that they are workable for health providers. It announced several clarifications to the rule in early July that are explained online at http://www.hhs.gov/ocr/hipaa.
Although President Bush announced this April that he wants to maintain strong privacy standards, health industry groups are hoping to lobby the Administration to ease the requirements.
Gellman says doctors and others probably don't need to stress out about complying with every last privacy mandate by April 2003. "It will probably take 10 years before there is substantial compliance with the privacy rule under any condition. For the most part, most institutions are going to have to look at privacy for the very first time. They are at ground zero," he tells WebMD
Gellman predicts that as the compliance deadline approaches, pressure to push it back will bring a 6-month or year extension.