(navigation image)
Home American Libraries | Canadian Libraries | Universal Library | Community Texts | Project Gutenberg | Children's Library | Biodiversity Heritage Library | Additional Collections
Search: Advanced Search
Anonymous User (login or join us)
Upload
See other formats

Full text of "Privacy of medical records : hearings before a subcommittee of the Committee on Government Operations, House of Representatives, Ninety-sixth Congress, first session, on H.R. 2979 and H.R. 3444"

PRIVACY OF MEDICAL RECORDS 



HEARINGS 

BEFORE A 

SUBCOMMITTEE OF THE 

COMMITTEE ON 
60YEENMENT OPERATIONS 
HOUSE OF REPRE8ENTATIYE8 

NINETY-SIXTH CONGRESS 

PIBST SESSION 
ON 

H.R. 2979 and H.R. 3444 

TO PROTECT THE PRIVACY OF MEDICAL RECORDS MAIN- 
TAINED BY MEDICAL CARE FACILITIES, TO AMEND SECTION 
552a OF TITLE 5, UNITED STATES CODE, AND FOR OTHER 

PURPOSES 



APRIL 4, 9, 11; JUNE 14; JULY 9, 14; AND SEPTEMBER 17, 1979 



Printed for the use of the Committee on Government Operations 




PRIVACY OF MEDICAL RECORDS 



HEARINGS 

BEFORE A 

SUBCOMMIHEE OF THE 

COMMITTEE ON 
GOVERNMENT OPERATIONS 
HOUSE OE REPRESENTATIVES 

NINETY-SIXTH CONGRESS 

FIRST SESSION 
ON 

H.R. 2979 and H.R. 3444 

TO PROTECT THE PRIVACY OF MEDICAL RECORDS MAIN- 
TAINED BY MEDICAL CARE FACILITIES, TO AMEND SECTION 
552a OF TITLE 5, UNITED STATES CODE, AND FOR OTHER 

PURPOSES 



APRIL 4, 9, 11; JUNE 14; JULY 9, 14; AND SEPTEMBER 17, 1979 



Printed for the use of the Committee on Government Operations 




ynx^^^hip^i/s 



U.S. GOVERNMENT PRINTING OFFICE 
60-4210 WASHINGTON : 1980 



COMMITTEE ON GOVERNMENT OPERATIONS 
JACK BROOKS, Texas, Chairman 



L. H. FOUNTAIN, North Carolina 

DANTE B. FASCELL, Florida 

WILLIAM S. MOORHEAD, Pennsylvania 

BENJAMIN S. ROSENTHAL, New York 

FERNAND J. ST GERMAIN, Rhode Island 

DON FUQUA, Florida 

JOHN CONYERS, Jr., Michigan 

CARDISS COLLINS, Illinois 

JOHN L. BURTON, California 

RICHARDSON PREYER, North Carolina 

ROBERT F. DRINAN, Massachusetts 

GLENN ENGLISH, Oklahoma 

ELLIOTT H. LEVITAS, Georgia 

DAVID W. EVANS, Indiana 

TOBY MOFFETT, Connecticut 

ANDREW MAGUIRE, New Jersey 

LES ASPIN, Wisconsin 

HENRY A. WAXMAN, California 

FLOYD J. FITHIAN, Indiana 

PETER H. KOSTMAYER, Pennsylvania 

TED WEISS, New York 

MIKE SYNAR, Oklahoma 

ROBERT T. MATSUI, California 

EUGENE V. ATKINSON, Pennsylvania 



FRANK HORTON, New York 
JOHN N. ERLENBORN, Illinois 
JOHN W. WYDLER, New York 
CLARENCE J. BROWN, Ohio 
PAUL M. McCLOSKEY, Jr., California 
THOMAS N. KINDNESS, Ohio 
ROBERT S. WALKER, Pennsylvania 
ARLAN STANGELAND, Minnesota 
M. CALDWELL BUTLER, Virginia 
LYLE WILLIAMS, Ohio 
JIM JEFFRIES, Kansas 
OLYMPIA J. SNOWE, Maine 
WAYNE GRISHAM, California 
JOEL DECKARD, Indiana 



William M. Jones, General Counsel 

John E. Moore, Staff Administrator 

Elmer W. Henderson, Senior Counsel 

John M. Duncan, Minority Staff Director 



Government Information and Individual Rights Subcommittee 

RICHARDSON PREYER, North Carolina, Chairman 

ROBERT F. DRINAN, Massachusetts THOMAS N. KINDNESS, Ohio 

GLENN ENGLISH, Oklahoma M. CALDWELL BUTLER, Virginia 

DAVID W. EVANS, Indiana JOHN N. ERLENBORN, Illinois 

PETER H. KOSTMAYER, Pennsylvania 
TED WEISS, New York 



JACK BROOKS, Texas 



Ex Officio 

FRANK HORTON, New York 

Timothy H. Ingram, Staff Director 

Robert Gellman, Associate Counsel 

EuPHON Metzger, Secretary 

Thomas G. Morr, Minority Professional Staff 

(II) 






CONTENTS 



Hearings held on — Page 

April 4 1 

April 9 305 

April 11 499 

June 14 597 

July 9 755 

July 14 809 

September 17 877 

Texts of H.R. 2979, H.R. 3444, and H.R. 5935 3, 38, 91 

Statement of — 

Anderson, Bette B., Under Secretary, Department of the Treasury; accom- 
panied iDy H. Stuart Knight, Director, Secret Service 727 

Beigler, Dr. Jerome S., chairperson, Committee on Confidentiality, Ameri- 
can Psychiatric Association 357 

Brown, Barry S., prosecutor of Monroe County, Ind., representing the 

National District Attorneys Association 943 

Coons, Gale, executive director, Indiana Dental Association, Indianapolis, 

Ind 857 

Crawford, Marshall, R., senior director. Blue Cross and Blue Shield Associ- 
ations 553 

Dawes, Dennis W., administrator, Hendricks County Hospital, Danville, 
Ind.; accompanied by John Render, general counsel to Indiana Hospital 

Association 844 

English, Michael J., Office of Legal Adviser, St. Elizabeths Hospital 623 

Erickson, Dr. James H., Director, Bureau of Medical Services, Public 

Health Service 607 

Freedman, Alfred M., M.D., president and chairman, National Commission 
on Confidentiality of Health Records; accompanied by Robert Belair, 

counsel; and Toby Levin, assistant executive director 232 

Geller, Henry, Assistant Secretary, Communications and Information, U.S. 
Department of Commerce; accompanied by Arthur Bushkin, Director, 
information policy program, National Telecommunications and Informa- 
tion Administration 141 

Cordis, Dr. Leon, representing the Society for Epidemiologic Research, and 

the Association of American Medical Colleges 461 

Hofmann, Dr. Adele, American Academy of Pediatrics 963 

Holbert, Kathleen, surgery coordinator, Johnson County Hospital, Frank- 
lin, Ind 834 

Huseland, Stanley A., director, governmental affairs. Blue Cross and Blue 
Shield of Indiana, Indianapolis, Ind.; accompanied by Donald J. Van 

Dyke, vice president, marketing administration division 823 

Johnson, Emery A., M.D., Director of the Indian Health Service, Health 

Services Administration 597 

Keeney, John C, Deputy Assistant Attorney General, Criminal Division, 
Department of Justice; accompanied by Abbe Lowell, Special Assistant to 
the Deputy Attorney General; Francis M. Mullen, Jr., Inspector-Deputy 
Assistant Director, Criminal Investigation Division, Federal Bureau of 

Investigation; and Pat Watson, Intelligence Division, FBI 756 

Krever, Justice Horace, Commissioner, Royal Commission of Inquiry Into 
the Confidentiality of Health Records, Toronto, Ontario; accompanied by 

Harvey Strosberg, Counsel 500 

Libassi, Peter, General Counsel, Department of Health, Education, and 
Welfare; accompanied by Darrel Grinstead, Acting Associate General 
Counsel 183 

(HI) 



IV 

Page 

Lowe, Richard, Deputy Inspector General, Department of Health, Educa- 
tion, and Welfare 801 

Marsden, Dr. John, executive director, Lilly Research Laboratories, Eli 

Lilly & Co., Indianapolis, Ind 813 

Moore, Dr. Donald, director, Larue Carter Psychiatric Hospital, Indianapo- 
lis, Ind 864 

Norman, C. Robert, administrator, Heritage House Convalescent Center, 
Shelbyville, Ind., on behalf of the Indiana Health Care Association; 
accompanied by Janet Coers, administrator. Heritage House Children's 
Center, Shelbj^ille, Ind 853 

Popplewell, Dr. Arvine G., president, Indiana State Medical Association, 

Indianapolis, Ind 859 

Prince, Harwood, director of medical records, Indiana University hospitals, 
Indianapolis, Ind 861 

Reindl, J. Michael, assistant executive director, Indiana Pharmaceutical 

Association, Indianapolis, Ind 819 

Rogers, Jane, director of legislative affairs, American Medical Record 
Association; accompanied by Lorraine Volz, director, medical record 
department, Thomas Jefferson University Hospital, Philadephia, Pa 306 

Shattuck, John H. F., director of the Washington office of the American 

Civil Liberties Union 576, 643 

Troyer, Leon, Woodbridge, Va 941 

Wolfe, Dr. Sidney M., Public Citizen Health Research Group 877 

Letters, statements, etc., submitted for the record by — 

Anderson, Bette B., Under Secretary, Department of the Treasury: Submis- 
sions to additional subcommittee requests 749-753 

Beigler, Dr. Jerome S., chairperson, Committee on Confidentiality, Ameri- 
can Psychiatric Association: Material relative to the hearings 365-453 

Brown, Barry S., prosecutor of Monroe County, Ind., representing the 

National District Attorneys Association: Prepared statement 951-962 

Crawford, Marshall R., senior director. Blue Cross and Blue Shield Associ- 
ations: 

Guidelines on preserving confidentiality of medical records 557-559 

Prepared statement 563-576 

English, Michael J., Office of Legal Adviser, St. Elizabeths Hospital: 

Prepared statement 626-635 

Erickson, Dr. James H., Director, Bureau of Medical Services, Public 

Health Service: Prepared statement 609-922 

Freedman, Alfred M., M.D., president and chairman, National Commission 
on Confidentiality of Health Records: Supplemental material relative to 
the hearings 241-304 

Geller, Henry, Assistant Secretary, Communications and Information, U.S 

Department of Commerce: Prepared statement 142-164 

Cordis, Dr. Leon, representing the Society for Epidemiologic Research, and 
the Association of American Medical Colleges: 

May 30, 1979, letter to Chairman Preyer concerning liability for 

nonconsensual disclosures of identifiable medical records 471-472 

Prepared statement 473-497 

Hofmann, Dr. Adele, American Academy of Pediatrics: Prepared state- 
ment 966-974 

Holbert, Kathleen, surgery coordinator, Johnson County Hospital, Frank 
lin, Ind.: 

Additional comments 842-843 

Malpractice Research, Inc., screens patient records 835 

Huseland, Stanley A., director, governmental affairs. Blue Cross and Blue 
Shield of Indiana, Indianapolis, Ind.: Request form 829 

Johnson, Emery A., M.D., Director of the Indian Health Service, Health 

Services Administration: Prepared statement 600-606 

Keeney, John C, Deputy Assistant Attorney General, Criminal Division, 
Department of Justice: 

August 1979, letter to Chairman Preyer re Department's comments 

regarding H.R. 2979 792-800 

Prepared statement 757-767 

Knight, H. Stuart, Director, Secret Service, Department of the Treasury: 
August 13, 1979, letter to Chairman Preyer re various State laws 

pertaining to the access of medical /mental health records 747 



V 

Page 

June 28, 1979, letter to Chairman Preyer re guidelines utilized by 
Secret Service field offices when contacting hospitals and mental 

institutions 742-743 

Prepared statement 732-735 

Krever, Justice Horace, Commissioner, Royal Commission of Inquiry Into the 
Confidentiality of Health Records, Toronto, Ontario: 

Executive orders 502-507 

Specimen reports made by private investigators 513-535 

Libassi, Peter, General Counsel, Department of Health, Education, and 
Welfare: 
April 19, 1979, memorandum from Darrel Grinstead, re obtaining 

medical information under false pretenses 190-192 

How present legislation ties in with the provisions of H.R. 3 of 1977 ... 205 

Intent of the bill 204 

Obtaining of records 199 

Prepared statement 209-231 

Moore, Dr. Donald, director, Larue Carter Psychiatric Hospital, Indianapo- 
lis, Ind.: Prepared statement 867-875 

Mullen, Francis M., Jr., Inspector-Deputy Assistant Director, Criminal 
Investigation Division, Federal Bureau of Investigation: Prepared state- 
ment 774-779 

Rogers, Jane, director of legislative affairs, American Medical Record 
Association: 

A.dditional material relative to the hearings 321-335 

Prepared statement 336-356 

Shattuck, John H. F., director of the Washington office of the American 
Civil Liberties Union: 

Prepared statement 577-596 

Supplement to statement and additional material 658-726 

Strosberg, Harvey, Counsel, Royal Commission of Inquiry Into the Confi- 
dentiality of Health Records, Toronto, Ontario: List of the member 

companies and groups of the Insurance Bureau of Canada 539-540 

Wolfe, Dr. Sidney M., Public Citizen Health Research Group: 

Comments before the Occupational Safety and Health Administration, 

U.S. Department of Labor, March 30, 1979 883-886 

Prepared statement 895-940 

APPENDIXES 

Appendix 1. — Letters submitting statements regarding privacy of medical 

records legislation 979 

A. Letter from Maurice Grossman, M.D., professor of psychiatry, Stanford 

University School of Medicine, submitting statement on privacy of 
medical records legislation 979 

B. Letter from A. Edward Doudera, executive director, American Society 

of Law & Medicine, submitting report on privacy of medical records 
legislation 1012 

C. Letter from John E. Affeldt, M.D., president. Joint Commission on 

Accreditation of Hospitals, submitting statement on privacy of medi- 
cal records legislation 1037 

D. Letter from Mylio S. Kraja, director. National Legislative Commission, 

the American Legion, submitting statement on privacy of medical 
records legislation 1050 

E. Letter from Dale Tooley, district attorney, second judicial district. State 

of Colorado, submitting testimony on privacy of medical records 
legislation 1062 

F. Letter from Edmund B. Rice, legislative representative, American Hos- 

pital Association, submitting statement on privacy of medical records 
legislation 1086 

G. Letter from James H. Sammons, M.D., executive vice president, Ameri- 

can Medical Association, submitting statement on privacy of medical 

records legislation 1128 

Appendix 2. — Letters commenting on privacy of medical records legislation 1157 

A. Letter from William Foley, Director, Administrative Office of the 

United States Courts 1157 

B. Letter from Robert Ellis Smith, publisher. Privacy Journal 1160 

C. Letter from Arthur Goshin, M.D., president, Health Care Plan 1161 



VI 

Page 

D. Letter from Boyd Thompson, executive vice president, American Associ- 

ation of Professional Standards Review Organization 1163 

E. Letter from Christopher C. Fordham III, M.D., dean, University of 

North Carolina Medical School 1165 

F. Letter from Jerome S. Beigler, M.D., clinical professor of psychiatry. 

University of Chicago 1166 

G. Letter from W. G. Anlyan, M.D., Duke University Medical Center 1168 

H. Letter from Donald A. Brennan, executive vice president. Group Health 

Cooperative of Puget Sound 1172 

I. Letter from Seymour Jablon, director. National Research Council 1176 

J. Letter from Elma L. Griesel, executive director, National Citizen's 

Coalition for Nursing Home Reform 1178 

K. Letter from James L. Oberstar, M.C., House of Representatives 1179 

L. Letter from Philip H. Taylor, M.D., chairman. Peer Review Sys- 
tems, Inc 1181 

M. Letters from Irwin N. Perr, M.D., J.D., professor of psychiatry. College 

of Medicine and Dentistry of New Jersey 1183 

N. Letter from John H. Romani, Ph. D., president, American Public 

Health Association 1192 

O. Letter from Edward A. Mortimer, Jr., M.D., Case Western Reserve 

University 1195 

P. Letter from John Reckless, M.D., F.A.C.P., the John Reckless Clinic 1198 

Q. Letter from Paul L. Thompson, national commander. Disabled Ameri- 
can Veterans 1200 

R. Letter from Perry L. Taylor, D.D.S., president, Delta Dental Plans 

Association 1203 

S. Letter from Donald H. Schwab, director. Veterans of Foreign Wars of 

the United States 1206 

T. Letter from John F. Heilman, national legislative director. Disabled 

American Veterans 1209 

U. Letter from Faye Wattleton, president. Planned Parenthood-World 
Population, Headquarters for Planned Parenthood Federation of 
America, Inc 1216 

V. Letter from R. Otto Meletzke, assistant general counsel, American 
Council of Life Insurance, and David J. Pattison, assistant Washing- 
ton counsel. Health Insurance Association of America 1223 

W. Letter from William M. Hermelin, administrator, American Health 

Care Association 1227 

X. Letter from Boyd Thompson, executive vice president, American Profes- 
sional Standards Review Organizations 1233 

Y. Letter from Marchia Kraft Goin, M.D., chairperson. Committee on 

Confidentiality, American Psychiatric Association 1234 



PRIVACY OF MEDICAL RECORDS 



WEDNESDAY, APRIL 4, 1979 

House of Representatives, 

Government Information 
AND Individual Rights Subcommittee 
OF THE Committee on Government Operations, 

Washington, D.C. 

The subcommittee met, pursuant to notice, at 10:10 a.m., in room 
2247, Rayburn House Office Building, Hon. Richardson Preyer 
(chairman of the subcommittee) presiding. 

Present: Representatives Richardson Preyer, David W. Evans, 
Peter H. Kostmayer, Ted Weiss, John N. Erlenborn, and Thomas 
N. Kindness. 

Also present: Timothy H. Ingram, staff director; Robert Gellman, 
counsel; Euphon Metzger, secretary, and Tom Morr, minority pro- 
fessional staff. Committee on Government Operations. 

Mr. Weiss [presiding]. Good morning. The Subcommittee on Gov- 
ernment Information and Individual Rights of the Government 
Operations Committee will come to order. 

As Mr. Preyer indicated, he has been called to a Standards and 
Ethics Subcommittee meeting. He will be back shortly. He asked us 
to proceed until he returns, What I would like to do is to read the 
opening statement which he had prepared. It will be entered into 
the record under his authorship. The statement says: 

"Today we begin hearings on legislation to protect the confiden- 
tiality of medical records. If he were available, our first witness 
would be Hippocrates, the Greek physician from the fourth century 
B.C. The Hippocratic oath, which is still in use today, includes this 
clause: 

■' 'Whatever, in connection with my professional practice, or not 
in connection with it, I see or hear, in the life of men, which ought 
not to be spoken abroad, I will not divulge, as reckoning that all 
such should be kept secret.' 

"Life has become more complicated since the days of ancient 
Greece. A one-sentence oath on medical confidentiality is no longer 
sufficient to cope with modern medical practice. One of the bills 
now before the subcommittee, H.R. 2979, is 35 pages long. The 
difference between one sentence and 35 pages is a striking reflec- 
tion of the complexity of our society. It may also be viewed as 
reflecting the tremendous progress in medicine and in the delivery 
of medical services. 

"As we consider this legislation, it is our responsibility to take 
into account the legitimate information needs of the modern health 
care system. Researchers, insurers, auditors, and others all have 
some need for medical information. 

(1) 



"However, we must also take into account the privacy interests 
of today's patient. Despite all of the changes in medicine in the last 
2,000 years, one constant is the patient's desire for privacy. It is 
this right to privacy that is most threatened by progress. 

"The growth in use and availability of personal information is 
not a characteristic unique to medicine. As the report of the Priva- 
cy Protection Study Commission reflects, threats to personal priva- 
cy come from many different sources. The need for action was 
underscored on Monday when Vice President Mondale announced 
the long-awaited administration initiative on privacy. 

"While we are chiefly concerned in these hearings with privacy 
of medical records, we will begin with a presentation of the admin- 
istration's general approach to privacy issues. Our first witness is 
Henry Geller, Assistant Secretary of Commerce for Communica- 
tions and Information." 

That is the chairman's statement. 

[The bills relative to the hearings follow:] 



96th congress 

1st Session 



H. R. 2979 



To protect the privacy of medical records maintained by medical care facilities, to 
amend section 552a of title 5, United States Code, and for other purposes. 



IN THE HOUSE OF REPRESENTATIVES 

March 14, 1979 

Mr. Preyer introduced the following bill; which was referred jointly to the 
Committees on Interstate and Foreign Commerce and Ways and Means 



A BILL 

To protect the privacy of medical records maintained by medical 
care facilities, to amend section 552a of title 5, United 
States Code, and for other purposes. 

1 Be it enacted by the Senate and House of Representa- 

2 tives of the United States of Amenca in Congress assembled, 

3 SHORT TITLE 

4 Section 1. This Act may be cited as the "Federal Pri- 

5 vacy of Medical Records Act". 

table of contents 

Sec. 1. Short title. 

Sec. 2. Findings and purposes. 



TABLE OF CONTENTS— Continued 

TITLE I— PRIVACY OF MEDICAL RECORDS 

Part A— Definitions; Effect on State Laws; Rights of Minors and 

Incompetents 

Sec. 101. Definitions. 

Sec. 102. Effect on State laws. 

Sec. 10.3. Rights of minors and incompetents. 

Part B — Rights of Access, Correction, and Notice, and Authorized 

Disclosure 

Sec. 111. Inspection of medical records. 

Sec. 112. Correction of medical records. 

Sec. 113. Notice of record keeping practices. 

Sec. 114. Disclosure of medical records. 

Sec. 115. Authorization for disclosure of medical records. 

Part C — Disclosure of Medical Records without Specific 
Authorization 

Sec. 121. Employee use. 

Sec. 122. Consultation. 

Sec. 12.3. Admission and health status information. 

Sec. 124. Research. 

Sec. 125. Audits and evalutions. 

Sec. 126. Health and safety. 

Sec. 127. Statutorily mandated disclosures. 

Sec. 128. Secret service or foreign intelligence. 

Sec. 129. Law enforcement functions. 

Sec. 130. Judicial and administrative proceedings. 

Sec. 131. Subpoenas, summons, and search warrants. 

Sec. 132. Other provisions relating to disclosures without specific authorization. 

Part D — Government Access, Challenge Rights, and Reporting 

Sec. 141. Access procedures. 
Sec. 142. Challenge procedures. 
Sec. 143. Reporting requirements. 

Past E — Enforcement 

Sec. 151. Compliance as a condition for participation in medicare and medicaid pro- 
grams. 
Sec. 152. Criminal penalty for obtaining a medical record through false pretenses. 
Sec. 153. Gvil suits. 

TITLE n— AMENDMENT TO TITLE 5, UNITED STATES CODE 

Sec. 201. Amendment to title 5, United States Code. 



3 

TABLE OF CONTENTS— Continued 

TITLE III— EFFECTIVE DATE AND REGl'LATIONS 

Sec. 301. Effective date. 

Sec. 302. Promulgation of regulations. 

1 FINDINGS AND PURPOSES 

2 Sec. 2. (a) Congress finds that — 

3 (1) the right to privacy is a personal and funda- 

4 mental right protected by the Constitution of the 

5 United States; 

6 (2) the collection, maintenance, use, and dissemi- 

7 nation of medical information can threaten an individ- 

8 ual's right to privacy; 

9 (3) the Federal Government is playing an increas- 

10 ingly important role in the provision, payment, and 

11 regulation of medical services; 

12 (4) medical information about an individual is rou- 

13 tinely made available to public and private organiza- 

14 tions for uses not directly related to the provision of 

15 medical services to the individual; 

16 (5) in order to prevent unfairness resulting from 

17 the misuse of medical information, an individual must 

18 be able to exercise more direct control over medical 

19 information; and 

20 (6) an individual's right to privacy must be bal- 

21 anced against the legitimate needs of public and pri- 

22 vate organizations for individually identifiable medical 



4 

1 information in performing their law enforcement, public 

2 health, research, fiscal, and other important functions. 

3 (b) The purposes of this Act are — 

4 (1) to establish procedures allowing individuals to 

5 inspect medical records relating to them and to make 

6 corrections in these records; and 

7 (2) to define the circumstances under which indi- 

8 vidually identifiable medical information may be dis- 

9 closed and to whom it may be disclosed. 

10 TITLE I— PRIVACY OF MEDICAL RECORDS 

11 Part A — Definitions, Effect of State Law, and 

12 Rights of Minors and Incompetents 

13 definitions 

14 Sec. 101. For purposes of this Act: 

15 (1) The term "accounting" means, with respect to 

16 a disclosure, the recording, as part of the medical 

17 record from which the disclosure was made, of the 

18 date, nature, and purpose of the disclosure, of the 

19 name and business address of the person to whom the 

20 disclosure was made, and of any written certification 

21 provided in order to obtain the record. 

22 (2) The term "audit" means [to be supplied]. 

23 (3) The term "employee" means, with respect to 

24 a facility or person, an individual who is employed by, 



5 

1 responsible to, or performing a function on behalf of, 

2 the facility or person. 

3 (4) The term "evaluation" means an assessment 

4 of effectiveness, efficiency, or compliance with applica- 

5 ble legal, fiscal, medical, scientific, or other appropriate 

6 standards or aspects of performance. 

7 (5) The term "government authority" means any 

8 agency or department of the United States, or of any 

9 territory or possession thereof, of any State or political 

10 subdivision thereof, of the District of Columbia, or of 

11 the Commonwealth of Puerto Rico, or any officer, em- 

12 ployee, or agent thereof. 

13 (6) The term "health research project" means a 

14 biomedical, epidemiologic, or health services research 

15 project or a health statistics project. 

16 (7) The term "health services" means [to be sup- 

17 plied]. 

18 (8)(A) The term "institutional review board" 

19 , means an Institutional Review Board established in ac- 

20 cordance vdth regulations of the Secretary under sec- 

21 tion 474 of the Public Health Service Act. 

22 (B) The term "appropriate institutional review 

23 board" means, with respect to a health research proj- 

24 ect intending to use the medical records maintained by 

25 a facility or researcher, (i) the institutional review 



8 



6 

1 board for the organization sponsoring the project, (ii) 

2 the institutional review board (if any) for the faciUty or 

3 researcher, or (iii) the institutional review board for an- 

4 other medical facility or institution the medical records 

5 of which also are intended to be used in the project. 

6 (9) The term "medical care facility" means — 

7 (A) a hospital, skilled nursing facility, or in- 

8 termediate care facility, or 

9 (B) another entity for which approval by the 

10 Secretary is required for participation in or cover- 

11 age under the program under title XV ill of the 

12 Social Security Act or for which certification by a 

13 State agency is required for participation in a pro- 

14 gram under title XIX of such Act, but only with 

15 respect to such provisions of this title as the Sec- 

16 retary makes applicable to such an entity by regu- 

17 lation, 

18 which is approved by the Secretary for participation in 

19 or coverage under the program under title XVIII of 

20 the Social Security Act or certified by a State agency 

21 or participation in a program under title XIX of such 

22 Act. Such term also includes an entity of the United 

23 States which is a hospital, skilled nursing facility, or 

24 intermediate care facility. 



7 

1 (10) The term "medical record" means any mate- 

2 rial that— 

3 (A)(i) contains information relating to the 

4 health, examination, care, or treatment of an indi- 

5 vidual, or (ii) is to be added to such materials 

6 under the provisions of this title, and 

7 (B) is in a form enabling the individual to be 

8 identified. 

9 (11) The term "Secretary" means the Secretary 

10 of Health, Education, and Welfare. 

11 EFFECT ON STATE LAWS 

12 Sec. 102. (a) Except as provided in subsection (b), this 

13 title supercedes any State or local laws governing the confi- 

14 dentiality of medical records maintained by medical care 

15 facilities to the extent that the records of such facilities are 

16 subject to this title. 

17 (b) This title does not supercede — 

18 (1) any restriction on the disclosure of medical 

19 records under (A) section 333 of the Comprehensive 

20 Alcohol Abuse and Alcoholism Prevention, Treatment 

21 and Rehabilitation Act of 1970 or (B) section 408 of 

22 the the Drug Abuse Office and Treatment Act of 

23 1972, 

24 (2) any other such restriction of Federal, State, or 

25 local law with respect to disclosure of medical records 



10 



8 

1 relating to alcohol or drug abuse, or treatment for such 

2 abuse, or 

3 (3) any restriction of Federal, State, or local law 

4 on access to or disclosure of medical records relating to 

5 psychiatric, psychological, or mental health treatment. 

6 EIGHTS OF MINORS AND INCOMPETENTS 

7 Sec. 103. The rights of (and obligations with respect to) 

8 an individual under this title shall be exercised and dis- 

9 charged through — 

10 (1) the parent or guardian of the individual, if the 

11 indi\^dual is under the age of majority (as determined 

12 under the laws of the jurisdiction in which the facility 

13 is located); or 

14 (2) an authorized legal representative of the indi- 

15 vidual, if the individual has been declared to be incom- 

16 petent by a court of competent jurisdiction. 

17 Part B — Rights of Access, Correction, and 

18 Notice, and Authorized Disclosure 

19 inspection of medical records 

20 Sec. 111. (a)(1) Except as provided under subsection 

21 (b), a medical care facility shall permit an individual to in- 

22 spect any medical record that the facility maintains about the 

23 individual, and shall permit the individual to have a copy of 

24 the record. The individual may, in accordance v^dth section 

25 115, authorize another person to inspect or to have a copy of 



11 



9 

1 the record and to accompany the individual during the in- 

2 spection. 

3 (2) A facility may require a written application for the 

4 inspection and copying of a medical record under this section 

5 and shall respond to a request for such an inspection or copy 

6 within 30 days of the date it receives the request. 

7 (3) A medical care facility may not charge a fee for 

8 permitting inspection of a record under this section. The fa- 

9 cility may charge a reasonable fee (no greater than the copy- 

10 ing fee imposed on third-party payers) for making a copy of 

1 1 such a medical record. 

12 (b) A medical care facility may deny an individual the 

13 right to inspect a medical record (or portion thereoO if it de- 

14 termines that the inspection might reasonably be expected to 

15 cause sufficient harm to the individual so as to outweigh the 

16 desirability of permitting access. If the right to inspect is 

17 denied, the facility shall permit an appropriate person (as de- 

18 fined by the Secretary) designated by the individual to in- 

19 spect the record involved. 

20 (c) The Secretary shall publish recommended criteria by 

21 which medical care facilities can determine, pursuant to sub- 

22 section (b), whether the inspection by an individual of the 

23 individual's medical records might reasonably be expected to 

24 cause sufficient harm to the individual so as to outweigh the 

25 desirability of permitting the inspection. 



12 



10 

1 CORRECTION OF MEDICAL RECORDS 

2 Sec. 112. Not later than 30 days after the date an indi- 

3 vidual requests in writing that a medical facility correct a 

4 medical record that the facility maintains about the 

5 individual, the facility shall either — 

6 (1)(A) make the correction requested; (B) inform 

7 the individual of the correction that has been made; 

8 and (C) upon the request of the individual, inform any 

9 person not employed by the facility and to whom the 

10 incorrect portion of the record was previously disclosed 

11 of the correction that has been made; or 

12 (2) inform the individual of (A) the reasons for its 

13 refusal to make the correction, (B) any procedures for 

14 further review of the refusal, and (C) the individual's 

15 right to file with the facility a concise statement set- 

16 ting forth the individual's reasons for disagreeing with 

17 the refusal of the facility. 

18 After an individual has filed a statement of disagreement, the 

19 facility, in any subsequent disclosure of the disputed portion 

20 of the record, shall include a copy of the individual's state- 

21 ment and may include a concise statement of the facility's 

22 reasons for not making the requested correction. 



13 



11 

1 NOTICE OF RECORD KEEPING PRACTICES 

2 Sec. 113. (a) A medical care facility shall, in accord- 

3 ance with subsection (b), provide an individual with a written 

4 notice of record keeping practices describing — 

5 (1) the categories of disclosures from a medical 

6 record that the facility may make under part C without 

7 the written authorization of the individual; 

8 (2) the individual's rights under this title, includ- 

9 ing the right to inspect medical records and the right 

10 to seek corrections of medical records; and 

11 (3) the procedures established by the facility for 

12 the exercise of these rights. 

13 (b) A notice of record keeping practices (described in 

14 subsection (a)) shall be provided to an individual — 

15 (1) when the facility first provides services to the 

16 individual after the effective date of this title; 

17 (2) when the facility first provides services to the 

18 individual more than one year after providing a previ- 

19 ous notice; and 

20 (3) when the facility first provides services to the 

21 individual after a substantial change has been made in 

22 the notice. 

23 (c) The Secretary shall promulgate by regulation a 

24 model notice of record keeping practices describing the cate- 

25 gories of disclosures and rights of individuals required to be 



14 



12 

1 included in notices of record keeping practices under para- 

2 graphs (1) and (2) of subsection (a). If a facility's notice of 

3 record keeping practices incorporates the model notice pro- 

4 mulgated by the Secretary under this subsection, the facili- 

5 ty's notice shall be deemed in compliance with the require- 

6 ments of paragraphs (1) and (2) of subsection (a) for such a 

7 notice. 

8 DISCLOSURE OF MEDICAL EECOEDS 

9 Sec. 114. A medical care facility — 

10 (1) may not disclose a medical record about an in- 

11 dividual other than to the individual (under section 

12 111) unless either (A) the individual has authorized the 

13 disclosure under section 115, or (B) the disclosure is 

14 permitted under part C without such an authorization; 

15 (2) may not disclose a medical record to any 

16 person unless the person is properly identified; and 

17 (3) shall, where practicable, limit disclosure of a 

18 medical record to information needed to accomplish the 

19 purpose for which the disclosure is made. 

20 AUTHORIZATION FOR DISCLOSURE OF MEDICAL RECORDS 

21 Sec. 115. (a) For purposes of this title, an individual 

22 has authorized disclosure to a person of information in a 

23 medical record maintained by a medical care facility only if — 

24 (1) the authorization is (A) in writing, (B) dated, 

25 and (C) signed by the individual; 



15 



13 

1 (2) the facility is specifically named or generically 

2 described in the authorization as authorized to disclose 

3 such information; 

4 (3) the person to whom the information is to be 

5 disclosed and the purpose for which the person may 

6 use the information are specifically named or generical- 

7 ly described in the authorization as a person to whom, 

8 and a purpose for which, such information may be dis- 

9 closed; and 

10 (4) the disclosure occurs before the date or event 

11 (if any), specified in the authorization, upon which the 

12 authorization expires. 

13 (b) An individual may in writing revoke or amend an 

14 authorization, in whole or in part, at any time. 

15 (c) A medical care facility that discloses information 

16 from a medical record pursuant to this section shall maintain 

17 a copy of the authorization as part of the medical record. 

18 Part C — Disclosure of Medical Records without 

19 Specific Authorization 

20 employee use 

21 Sec. 121. A medical care facility may disclose a medi- 

22 cal record it maintains about an individual, vdthout the au- 

23 thorization described in section 115(a), if the disclosure is to 

24 an employee of the facility who has a need for the medical 

25 record in the performance of his duties. 



16 



14 

1 CONSULTATION 

2 Sec. 122. A medical care facility may disclose a medi- 

3 cal record it maintains about an individual, without the au- 

4 thorization described in section 115(a), if the disclosure is to 

5 a medical care professional who is consulted by the facility in 

6 connection with health services provided to the individual. 

7 ADMISSION AND HEALTH STATUS INFORMATION 

8 Sec. 123. A medical care facility may disclose a medi- 

9 cal record it maintains about an individual, without the au- 

10 thorization described in section 115(a), if the disclosure only 

11 reveals the presence of the individual at the facility or the 

12 provision of services to the individual at the facility, his loca- 

13 tion in the facility, and his general condition, and — 

14 (1) the individual has not objected to the disclo- 

15 sure, and 

16 (2) the information does not reveal specific infor- 

17 mation about the individual's condition or treatment. 

18 HEALTH RESEARCH 

19 Sec. 124. (a) A medical care facility may disclose a 

20 medical record it maintains about an individual, without the 

21 authorization described in section 115(a), if — 

22 (1) the disclosure is for use in a health research 

23 project (as defined in section 101(6)) which has been 

24 determined by an appropriate institutional review board 

25 (as defined in section 101(8)(B)) to be of sufficient im- 



17 



15 

1 portance so as to outweigh the intrusion into the priva- 

2 cy of the individual that would result from the disclo- 

3 sure, and 

4 (2) the facility has provided to the person to 

5 whom the information is disclosed a copy of the notice 

6 (published by the Secretary under subsection (c)) of the 

7 requirements of subsection (b). 

8 (b) Any person who obtains a medical record pursuant 

9 to subsection (a) shall — 

10 (1) maintain the medical record in compliance 

11 with the security standards prescribed by the Secretary 

12 pursuant to section 132(b)(1); 

13 (2) remove, where practicable, information en- 

14 abling individuals to be identified; 

15 (3) not disclose in any public report information 

16 contained in the record and enabling individuals to be 

17 identified; and 

18 (4) not further use or disclose the information con- 

19 tained in the record and enabling the individuals to be 

20 identified, except — 

21 (A) for disclosure to an employee of the 

22 person who has a need for the information in per- 

23 forming his duties under the project, 



18 

16 

1 (B) in compelling circumstances affecting the 

2 health or safety of any person or involving immi- 

3 nent danger of serious property damage, 

4 (C) for use in another health research proj- 

5 ect, under the same restrictions on use and disclo- 

6 sure (including approval by an appropriate institu- 

7 tional review board) applicable under this subsec- 

8 tion to the original project, and 

9 (D) for disclosure to a properly identified 

10 person for the purpose of an audit or evaluation 

11 related to the project. 

12 (c) The Secretary shall publish a notice, available for 

13 use by medical care facilities, which accurately describes the 

14 conditions, described in subsection (b), for the maintenance, 

15 use, and further disclosure of information disclosed under this 

16 section. 

17 AUDITS AND EVALUATIONS 

18 Sec. 125. (a) A medical care facility may disclose a 

19 medical record it maintains about an individual, without the 

20 authorization described in section 115(a), if — 

21 (1) the disclosure is for the purpose of an audit or 

22 evaluation, and 

23 (2) the facility has provided to the person to 

24 whom the information is disclosed a copy of the notice 



19 



17 

1 (published by the Secretary under subsection (c)) of the 

2 requirements of subsection (b). 

3 (b) Any person who obtains a medical record pursuant 

4 to subsection (a) shall — 

5 (1) maintain the medical record in compliance 

6 with the security standards prescribed by the Secretary 

7 pursuant to section 132(b)(1); 

8 (2) remove, where practicable, information 

9 enabling individuals to be identified; 

10 (3) not disclose in any public report information 

11 contained in the record and enabling individuals to be 

12 identified; and 

13 (4) not further use or disclose the information con- 

14 tained in the record and enabling the individuals to be 

15 identified, except — . 

16 (A) for disclosure to an employee of the 

17 person who has a need for the information in per- 

18 forming his duties under the audit or evaluation, 

19 (B) for disclosure to the person for whom the 

20 audit or evaluation is being carried out, 

21 (C) in compelling circumstances affecting the 

22 health or safety of any person or involving immi- 

23 nent danger of serious property damage, and 

24 (D) when required by Federal or State law. 



20 



18 

1 (c) The Secretary shall publish a notice, available for 

2 use by medical care facilities, which accurately describes the 

3 conditions, described in subsection (b), for the maintenance, 

4 use, and further disclosure of information disclosed under this 

5 section. 

6 HEALTH AND SAFETY 

7 Sec. 126. (a) A medical care facility may disclose a 

8 medical record it maintains about an individual, without the 

9 authorization described in section 115(a), if the disclosure 

10 is— 

11 (1) to assist in the identification of a dead person, 

12 or 

13 (2) pursuant to a showing of compelling circum- 

14 stances (A) affecting the health or safety of any person 

15 or (B) involving imminent danger of serious property 

16 damage, 

17 and the facility maintains an accounting (as defined in section 

18 101(1)) of the disclosure. 

19 (b) Medical records disclosed by a medical care facility 

20 to a governmental authority under this section shall not be 

21 further disclosed by the authority except, if not otherwise 

22 prohibited by law — 

23 (1) where necessary to fulfill the purpose for 

24 which the record was obtained, or 



21 



19 

1 (2) for the purposes, and subject to the conditions 

2 (other than any requirement that an accounting be 

3 maintained), specified in sections 124 through 131. 

4 STATUTORILY MANDATED DISCLOSURES 

5 Sec. 127. (a) A medical care facility may disclose a 

6 medical record it maintains about an individual, without the 

7 authorization described in section 115(a), if the disclosure is 

8 to a governmental authority pursuant to a Federal or State 

9 law requiring the disclosure of the record to the authority. 

10 (b) Medical records disclosed by a medical care facility 

11 to a governmental authority under this section shall not be , 

12 further disclosed by the authority except, if not otherwise 

13 prohibited by law — 

14 (1) where necessary to fulfill the purpose for 

15 which the record was obtained, or 

16 (2) for the purposes, and subject to the conditions 

17 (other than any requirement that an accounting be 

18 maintained), specified in sections 124 through 131. 

19 SECRET service OR FOREIGN INTELLIGENCE 

20 Sec. 128. (a) A medical care facility may disclose a 

21 medical record it maintains about an individual, without the 

22 authorization described in section 115(a), if the disclosure 

23 is— 

24 (1) to— 



22 



20 

1 (A) the United States Secret Service for the 

2 purpose of conducting its protective functions 

3 under section 3056 of title 18, United States 

4 Code (relating to Secret Service powers), under 

5 section 202 of title 3, United States Code (relat- 

6 ing to the Executive Protective Service), or under 

7 Public Law 90-331 (relating to Secret Service 

8 protection of Presidential and Vice Presidential 

9 candidates), or 

XO (B) an authority of the United States author- 

11 ized to conduct foreign counter- or positive-intelli- 

12 gence activities for the purpose of conducting such 

13 activities, and 

14 (2) the government authority seeking the disclo- 

15 sure provides the facility with a written certification, 

16 signed by a supervisory official of a rank designated by 

17 the head of the government authority, that the record 

18 is being sought for a legitimate Secret Service or for- 

19 eign intelligence purpose. 

20 (b) No medical care facility, or employee of the facility, 

21 shall disclose to any person that a government authority has 

22 sought or obtained access to a medical record under this sec- 

23 tion. 

24 (c) Medical records disclosed by a medical care facility 

25 to a governmental authority under this section shall not be 



23 



21 

1 further disclosed by the authority except, if not otherwise 

2 prohibited by law where necessary to fulfill the purpose for 

3 which the record was obtained, 

4 LAW ENFORCEMENT FUNCTIONS 

5 Sec. 129. (a) A medical care facility may disclose a 

6 medical record it maintains about an individual, without the 

7 authorization described in section 115(a), if the disclosure is 

8 to a government authority, and is — 

9 (1)(A) for use in an investigation or prosecution 

10 (directed at any person other than the individual) of 

11 fraud, abuse, or waste in a program or project funded 

12 or operated by a government authority, or (B) to assist 

13 in the identification or location of a suspect or fugitive 

14 in a legitimate law enforcement inquiry; 

15 (2) the government authority seeking the disclo- 

16 sure provides the facility with a written certification, 

17 signed by a supervisory official of a rank designated by 

18 the head of the government authority, that the record 

19 is being sought for a legitimate purpose under this sec- 

20 tion; and 

21 (3) the facility maintains an accounting (as defined 

22 in section 101(1)) of the disclosure. 

23 (b) Medical records disclosed by a medical care facility 

24 to a governmental authority under this section shall not be 



24 



22 

1 further disclosed by the authority except, if not otherwise 

2 prohibited by law — 

3 (1) where necessary to fulfill the purpose for 

4 which the record was obtained, or 

5 (2) for the purposes, and subject to the conditions 

6 (other than any requirement that an accounting be 

7 maintained), specified in sections 124 through 131. 

8 JUDICIAL AND ADMINISTRATIVE PROCEEDINGS 

9 Sec. 130. (a) A medical care facility may disclose a 

10 medical record it maintains about an individual, without the 

11 authorization described in section 115(a), if the disclosure is 

12 not otherwise prohibited by law, is made pursuant to the 

13 Federal Rules of Civil or Criminal Procedure or comparable 

14 rules of other courts or administrative agencies in connection 

15 with litigation or proceedings to which the individual is a 

16 party. 

17 (b) Medical records disclosed by a medical care facility 

18 to a governmental authority under this section shall not be 

19 further disclosed by the authority except, if not otherwise 

20 prohibited by law — 

21 (1) where necessary to fulfill the purpose for 

22 which the record was obtained, or 

23 (2) for the purposes, and subject to the conditions 

24 (other than any requirement that an accounting be 

25 maintained), specified in sections 124 through 131. 



25 



23 

1 SUBPOENAS, SUMMONS, AND SEARCH WARRANTS 

2 Sec. 131. (a) A medical care facility may disclose a 

3 medical record it maintains about an individual, without the 

4 authorization described in section 115(a), if — 

5 (1) the disclosure is pursuant to an administrative, 

6 judicial, or grand jury summons or subpoena or pursu- 

7 ant to a search warrant; 

8 (2) the facility is provided a written certification 

9 by the person seeking the record that the person has 

10 complied with the access provisions of section 141; and 

11 (3) the facility maintains a copy of the summons, 

12 subpoena, or search warrant as part of the medical 

13 record. 

14 (b) Medical records about an individual disclosed by a 

15 medical care facility under this section pursuant to a subpoe- 

16 na issued under the authority of a Federal giand jury — 

17 (1) shall be returned and actually presented to the 

18 grand jury; 

19 (2) shall be used only for the purpose of consider- 

20 ing whether to issue an indictment or presentment by 

21 that grand jury, or of prosecuting a crime for which 

22 that indictment or presentment is issued, or for a pur- 

23 pose authorized by rule 6(e) of the Federal Rules of 

24 Criminal Procedure; 



26 



24 

1 (3) shall be destroyed or returned to the medical 

2 care facility if not used for one of the purposes speci- 

3 fied in paragraph (2); and 

4 (4) shall not be maintained, or a description of the 

5 contents of such records shall not be maintained, by 

6 any government authority other than in the sealed rec- 

7 ords of the grand jury, unless such record has been 

8 used in the prosecution of a crime for which the grand 

9 jury issued an indictment or presentment or for a pur- 

10 pose authorized by rule 6(e) of the Federal Rules of 

11 Criminal Procedure. 

12 (c) Medical records disclosed by a medical care facility 

13 to a governmental authority under this section shall not be 

14 further disclosed by the authority except, if not otherwise 

15 prohibited by law — 

16 (1) where necessary to fulfill the purpose for 

17 which the record was obtained, or 

18 (2) for the purposes, and subject to the conditions 

19 (other than any requirement that an accounting be 

20 maintained), specified in sections 124 through 131. 

21 OTHER PROVISIONS RELATING TO DISCLOSURES WITHOUT 

22 SPECIFIC AUTHORIZATION 

23 Sec. 132. (a) Nothing in this part shall be construed as 

24 requiring a medical care facility to disclose information not 

25 otherwise required to be disclosed by law. 



27 



25 

1 (b)(1) The Secretary shall prescribe security standards 

2 with respect to the use and maintenance by researchers, 

3 auditors, and evaluators of identifiable medical record infor- 

4 mation disclosed by facilities under sections 124 and 125. 

5 The standards shall establish appropriate administrative, 

6 technical, and physical safeguards for insuring the security 

7 and confidentiality of these records. The Secretary may pre- 

8 scribe different standards for researchers, auditors, and 

9 evaluators, and may vary the standards according to the sen- 

10 sitivity of the information disclosed. 

11 (2) The Secretary shall publish guidelines on how medi- 

12 cal care facilities can fulfill the accounting requirement of 

13 sections 126 and 129, including suggestions for such methods 

14 and procedures as will meet this requirement inexpensively 

15 and with minimal disruption to the medical treatment process 

16 and to standard record keeping practices. 

17 (c) The Secretary shall prepare a notice, for use under 

18 section 141(a)(2), detailing the rights of an individual who 

19 wishes to challenge, under section 142, the disclosure of the 

20 individual's medical record under such section. 

21 Part D — Government Access, Challenge Rights, 

22 AND Reporting 

23 access procedures 

24 Sec. 141. (a) A government authority may obtain a 

25 medical record about an individual from a medical care facili- 



28 



26 

1 ty pursuant to an administrative, judicial, or grand jury sum- 

2 mons or subpoena under section 131, if not otherwise prohib- 

3 ited by law, only if — 

4- (1) there is reasonable cause to believe that the 

5 record will produce information relevant to a legitimate 

6 law enforcement inquiry being conducted by the gov- 

7 ernment authority; 

8 (2) except as provided in subsection (c), a copy of 

9 the summons or subpoena has been served upon the in- 

10 dividual or mailed to his last known address on or 

11 before the date on which the summons or subpoena 

12 was served on the medical care facility, together with 

13 a notice (published by the Secretary under section 

14 132(c)) of the individual's right of challenge under 

15 section 142; and 

16 (3)(A) 14 days have passed from the date of serv- 

17 ice or mailing and within such time period the individu- 

18 al has not initiated a challenge in accordance with sec- 

19 tion 142, or 

20 (B) it is ordered by a court under section 142. 

21 (b) A government authority may obtain a medical record 

22 about an individual from a medical care facility pursuant to a 

23 search warrant if, not later than 30 days after the date the 

24 search warrant was served on the medical care facility, it 

25 serves the individual with, or mails to the last known address 



29 



27 

1 of the individual, a copy of the search warrant together with 

2 the notice (published by the Secretary under section 132(c)) 

3 of the individual's right of challenge under section 142. 

4 (c)(1) A government authority may apply to an appropri- 

5 ate court to delay (for an initial period of not longer than 90 

6 days) serving a copy of a summons or subpoena and a notice 

7 otherwise required under subsection (a)(2) with respect to a 

8 law enforcement inquiry. The government authority may 

9 apply to the court for extensions of the delay. 

10 (2) An appUcation for a delay, or extension of a delay, 

11 under this subsection shall state, with reasonable specificity, 

12 the reasons why the delay or extension is being sought. 

13 (3) If the court finds that— 

14 (A) the inquiry being conducted is within the 

15 lawful jurisdiction of the government authority seeking 

16 the medical records; 

17 (B) there is reasonable cause to believe that the 

18 records being sought will produce information relevant 

19 to the inquiry; 

20 (C) the government authority's need for the 

21 record in the inquiry outweighs the individual's privacy 

22 interest; and 

23 (D) there is reasonable cause to believe that re- 

24 ceipt of a notice by the individual will result in — 



30 



28 

1 (i) endangering the life or physical safety of 

2 any person; 

3 (ii) flight from prosecution; 

4 (iii) destruction of or tampering with evi- 

5 dence; " 

6 (iv) intimidation of potential witnesses; or 

7 (v) jeopardy (with a comparable degree of se- 

8 riousness to the circumstances described in 

9 clauses (i) through (iv)) to an investigation or offi- 

10 cial proceeding or undue delay in trial or ongoing 

11 official proceeding, 

12 the court shall enter an ex parte order delaying, or extending 

13 the delay of, the notice and an order prohibiting the medical 

14 care facility from revealing the request for, or the disclosure 

15 of, the records. 

16 (3) Upon the expiration of a period of delay of notice 

17 under this subsection, the government authority shall serve, 

18 with the service of the summons or subpoena and the notice, 

19 a copy of any applications filed and approved under this sub- 

20 section. 

21 CHALLENGE PROCEDURES 

22 Sec. 142. (a) Within 14 days of the date of service or 

23 mailing of a summons or subpoena of a government authority 

24 seeking a medical record about an individual from a medical 

25 care facility under section 131, the individual may file in the 



31 



29 

1 appropriate United States district court or state court a 

2 motion to quash the the subpoena or summons, with a copy 

3 served upon the government authority (specified in the notice 

4 which the individual received under section 131(a)) by deHv- 

5 ery or registered or certified mail. 

6 (b)(1) Upon receipt of such a motion, the government 

7 authority may file with the appropriate court such affidavits 

8 and other sworn documents as sustain the validity of the 

9 summons or subpoena. The individual may file, within five 

10 days of the date of the authority's filing, affidavits and sworn 

1 1 documents in response to the authority's filing. 

12 (c) If the court is unable to determine the motion on the 

13 basis of the initial filings, the court may conduct additional 

14 proceedings as it deems appropriate. All such proceedings 

15 shall be completed, and the motion decided, within ten calen- 

16 dar days of date of the government authority's filing. 

17 (d)(1) A court may only deny an individual's timely 

18 motion under subsection (a) if it finds that there is reasonable 

19 cause to believe that the law enforcement inquiry is legiti- 

20 mate and that the records sought are relevant to that inquiry, 

21 and the court shall sustain the motion if it finds that the 

22 individual's privacy interest outweighs the government auth- 

23 ority's need for the record. 

24 (2) The court may assess against a Federal government 

25 authority reasonable attorney fees and other litigation costs 



32 



30 

1 reasonably incurred in the case of any motion brought under 

2 subsection (a) against the authority and in which the individ- 

3 ual has substantially prevailed. 

4 (e) A court ruling enforcing process imder this section 

5 shall not be deemed a final order and no interlocutory appeal 

6 may be taken therefrom by the individual. An appeal of a 

7 ruling enforcing the process under this section may be taken 

8 by the individual (1) within such period of time as provided 

9 by law as part of any appeal from a final order in any legal 

10 proceeding initiated against him arising out of or based upon 

11 the medical record, or (2) within 30 days after a notification 

12 that no legal proceeding is contemplated against him. The 

13 government authority obtaining the medical record shall 

14 promptly notify an individual when a determination has been 

15 made that no legal proceeding against him is contemplated. 

16 After 180 days from the date of the enforcement of the proc- 

17 ess, if the government authority obtaining the record has not 

18 initiated such a proceeding, a supervisory official of the gov- 

19 ernme'nt authority shall certify to the appropriate court that 

20 no such determination has been made. The court may require 

21 that such certifications be made at reasonable intervals there- 

22 after, until either notification to the individual has occurred 

23 or a legal proceeding is initiated as described in clause (1). 

24 (f) The challenge procedures of this section constitute 

25 the sole judicial remedy available to an individual to prevent 



33 



31 

1 disclosure of a medical record pursuant to a judicial or admin- 

2 istrative summons or subpoena. 

3 (g) Nothing in this section shall enlarge or restrict any 

4 rights of a medical care facility to challenge requests for a 

5 medical record made by a government authority under exist- 

6 ing law. Nothing in this section shall entitle an individual to 

7 assert the rights of a medical care facility. 

8 EEPORTING REQUIREMENTS 

9 Sec. 143. In April of each year (beginning with the 

10 year after the year in which this Act is enacted), each Feder- 

11 al government authority that requests access to medical rec- 

12 ords from a medical care facility pursuant to sections 126 

13 through 131, shall submit a report to the Speaker of the 

14 House of Representatives and the President of the Senate, 

15 for referral to the appropriate committees of Congress, which 

16 report shall include the number of (1) requests for medical 

17 records made under each of such sections, (2) delays of notice 

18 sought under section 141(c), (3) successful and unsuccessful 

19 challenges made under section 142, in the proceeding calen- 

20 dar year, and such other information as the authority deems 

21 appropriate. 



34 



32 

1 Part E — Enforcement 

2 compliance as a condition for participation in 

3 medicare and medicaid programs 

4 Sec. 151. (a) A medical care facility may not partici- 

5 pate and may not continue to participate in the program 

6 under title XVDI of the Social Security Act unless the facili- 

7 ty provides adequate assurances, and evidence from time to 

8 time, to the Secretary of its substantial compliance with the 

9 provisions of parts B and C of this title. 

10 (b)(1) Except as provided in paragraph (2), a medical 

11 care facility may not participate and may not continue to 

12 participate in the program of a State under title XIX of the 

13 Social Security Act unless the facility provides adequate as- 

14 surances, and evidence from time to time, to an appropriate 

15 State agency (as determined under regulations of the Secre- 

16 tary) of its substantial compliance with the provisions of parts 

17 B and C of this title. 

18 (2) A medical care facility is not required to provide the 

19 assurances and evidence otherwise required under paragraph 

20 (1) if it has provided the assurances and evidence required 

21 under subsection (a). 

22 CRIMINAL PENALTY FOR OBTAINING A MEDICAL RECORD 

23 THROUGH FALSE PRETENSES 

24 Sec. 152. Any person who, under false or fraudulent 

25 pretenses or with a false or fraudulent certification required 



35 



33 

1 under this Act, requests or obtains a medical record about an 

2 individual from a medical care facility or an authorization 

3 from an individual to disclose such a record shall be fined not 

4 more than $10,000, or imprisoned for not more than one 

5 year, or both. 

6 CIVIL SUITS 

7 Sec. 153. (a) Any person aggrieved as a result of — 

8 (1) a violation by a medical care facility, govern- 

9 ment authority, researcher, auditor, or evaluator of any 

10 provision of part B or C of this title, or 

11 (2) the commission by a person of an act which 

12 constitutes a crime under section 152, 

13 may bring a civil action in any appropriate United States 

14 district court, without regard to the amount in controversy, 

15 or in any other court of competent jurisdiction, against the 

16 medical care facility, government authority, researcher, audi- 

17 tor, evaluator, or other person, respectively. 

18 (b) If the court determines in such an action that a vio- 

19 lation or commission has occurred, the aggrieved person 

20 may — 

21 (1) recover the sum of — 

22 (A) actual damages sustained as a result of 

23 the violation or commission or $1,000, whichever 

24 is greater, and 



36 



34 

1 (B) the costs of the action together with rea- 

2 sonable attorney fees as determined by the court; 

3 and 

4 (2) obtain such other relief, including punitive 

5 damages and equitable relief, as the court determines 

6 to be appropriate. 

7 TITLE n— AMENDMENT TO TITLE 5, UNITED 

8 STATES CODE 

9 AMENDMENT TO TITLE 5, UNITED STATES CODE 

10 Sec. 201. Section 552a of title 5, United States Code, 

11 is amended by adding at the end the following new subsec- 

12 tion: 

13 "(r) Any medical record contamed in a system of rec- 

14 ords maintained by a medical care facility subject to title I of 

15 the Federal Privacy of Medical Records Act shall not be sub- 

16 ject to the provisions of subsections (b) through (d), (e)(3), 

17 (e)(ll), (0(3), and (g) through (k) of this section, If the malnte- 

18 nance and disclosure of the medical record are subject to the 

19 provisions of such title.". 

20 TITLE m— EFFECTIVE DATE AND REGULATIONS 

21 EFFECTIVE DATE AND PEOMULGATION OF REGULATIONS 

22 Sec. 301. This Act and the amendments made by this 

23 Act shall take effect on the first day of the first calendar 

24 quarter beginning more than 180 days after the date of the 

25 enactment of this Act. 



37 



35 

1 PROMULGATION OF REGULATIONS 

2 Sec. 302. The Secretary shall first establish final regu- 

3 lations to carry out the amendments made by this Act not 

4 later than the first day of the second month that begins 

5 before the effective date of such amendments (as specified 

6 under section 301). 



38 



96th congress 
1st Session 



H. R. 3444 



To protect the privacy of medical information, to amend the Privacy Act of 1974, 

and for other purposes. 



IN THE HOUSE OF REPRESENTATIVES 

April 4, 1979 
Mr. Preyer (for himself and Mr. Goldwater) (by request) introduced the 
following bill; which was referred jointly to the Committees on Government 
Operations, Interstate and Foreign Commerce, and Ways and Means 



A BILL 

To protect the privacy of medical information, to amend the 
Privacy Act of 1974, and for other purposes. 

1 Be it enacted by the Senate and House of Representa- 

2 tives of the United States of America in Congress assembled, 

3 SHORT TITLE 

4 Section 1. This Act may be cited as the "Privacy of 

5 Medical Information Act". 



39 



2 

1 FINDINGS 

2 Sec. 2. The Congress finds that — 

3 (1) the right to privacy is a personal and funda- 

4 mental right, 

5 (2) rapidly changing technology permits record- 

6 keepers to compile and disseminate more detailed and 

7 highly personal information about individuals than ever 

8 before, 

9 (3) the collection, maintenance, use, and dissemi- 

10 nation of confidential medical information can threaten 

11 the individual's right to privacy, 

12 (4) individuals should be able to exercise more 

13 direct control over confidential medical information, 

14 particularly since the availability of such information to 

15 third parties often affects the individual's abiUty to 

16 obtain employment, insurance, medical care, and other 

17 important benefits, 

18 (5) all health care providers affect interstate com- 

19 merce, due to the complex and interrelated nature of 

20 the medical care system, and 

21 (6) there is a need for Federal statutory protection 

22 of the privacy of medical information maintained by 

23 health care providers. 



40 



3 

1 TITLE I— REQUIREMENTS APPLICABLE TO 

2 MEDICAL CARE FACILITIES 

3 individual's access to medical information 

4 Sec. 101. (a) A medical care facility shall (except as 

5 provided in subsection (b)), upon request of an individual, pro- 

6 vide, at the choice of the individual, (1) the individual, or (2) 

7 a person designated by the individual, within twenty working 

8 days an opportunity to inspect, and a copy of, any medical 

9 information that the facility maintains concerning the 

10 individual. 

11 (b) A medical care facility shall provide within twenty 

12 working days an appropriate person (as defined in regulations 

13 of the Secretary) designated by the individual an opportunity 

14 to inspect, and a copy of, medical information that the facility 

15 maintains concerning the individual, in those circumstances 

16 in which the facility determines that the application of the 

17 requirements of subsection (a) would be likely to be sufficient- 

18 ly harmful to the individual or to another person so as to 

19 outweigh the desirabiUty of applying those requirements. 

20 (c) A medical care facility may not impose a charge for 

21 permitting an inspection of, and may impose only a reason- 

22 able charge (in any event no greater than the charge imposed 

23 on third persons) for providing a copy of, medical information 

24 under this section. 



41 



4 

1 CORRECTION OF MEDICAL INFORMATION 

2 Sec. 102. (a) If an individual requests that a medical 

3 care facility correct medical information that the facility 

4 maintains concerning the individual, the facility shall, within 

5 ninety calendar days, either — 

6 (1) amend or supplement the medical information 

7 to make the correction requested, or 

8 (2)(A) inform the individual of its refusal to do so, 

9 the reasons for the refusal, and of the facihty's proce- 

10 dures, if any, for further review of the refusal, and 

11 (B) permit the individual to file with the facility a 

12 concise statement setting forth any correction request- 

13 ed, but not made, by the facility, and the reasons for 

14 requesting that correction. 

15 (b) The facility shall, if the individual so requests, inform 

16 the individual of any disclosure that the facility previously 

17 made of the information to which a correction has been re- 

18 quested, if the facility has maintained a notation of the 

19 disclosure. 

20 (c) The facility shall provide any person, specifically 

21 designated by the individual, to whom the information was 

22 previously disclosed a copy of any correction made, and of 

23 any statement filed as provided under subsection (a)(2)(B). 

24 (d) The facility shall, in any subsequent disclosure of the 

25 information to which a correction was requested, include any 



42 



5 

1 correction made, and any statement filed as provided under 

2 subsection (a)(2)(B). 

3 NOTIFICATION OF DISCLOSURE OF MEDICAL INFOEMATION 

4 Sec. 103. (a) On or prior to the effective date of this 

5 Act, a medical care facility shall prepare a notice of the dis- 

6 closures that may be made by the medical care facility of 

7 medical information concerning an individual without the au- 

8 thorization of the individual, and the procedures, if any by 

9 which an individual can learn of each such disclosure. 

10 (b) A medical care facility shall provide the notice re- 

11 quired by subsection (a) to an individual: 

12 (1) where reasonably possible, when first provid- 

13 ing medical services to the individual, and 

14 (2) upon request of an individual who has re- 

15 ceived, or may receive, medical care services from the 

16 medical care facility. 

17 LIMITATION OF DISCLOSURE TO PROPERLY IDENTIFIED 

18 PERSONS AND TO PURPOSE FOR WHICH NEEDED 

19 Sec. 104. A medical care facility may disclose medical 

20 information concerning an individual only to properly identi- 

21 fied persons, and (except for disclosures to Federal or State 

22 authorities) only to the extent needed to accomplish the pur- 

23 pose for which the disclosure is to be made. 



43 



6 

1 CONDITIONS FOR DISCLOSURE OF MEDICAL INFORMATION 

2 Sec 105. (a) A medical care facility may not disclose 

3 medical information that it maintains concerning an individu- 

4 al, except as provided in subsection (b), unless the individual 

5 has authorized the disclosure as provided in subsection (d) 

6 and the facility has complied with subsection (e). 

7 (b) The provisions of subsection (a) shall not apply to a 

8 disclosure by a medical care facility — 

9 (1) to a person employed by, an agent of, or re- 

10 sponsible to, the facility, to the extent that the person 

11 needs the information to carry out his duties, 

12 (2) to a health care provider, in connection with 

13 health services being provided to the individual, 

14 (3) consistent with accepted medical practice, to 

15 the next of kin or persons with whom the individual 

16 has a personal relationship, 

17 (4) in compelling circumstances which the facility 

18 has in good faith determined will affect the health or 

19 safety of the individual or another person, if a notation 

20 of the disclosure (and to whom the information was 

21 disclosed) is made part of the medical information that 

22 the facility maintains concerning the individual, 

23 (5) for use in a biomedical, epidemiologic, or 

24 health services research project, or a health statistics 

25 project, if — 



44 



7 

1 (A) the facility reasonably determines that — 

2 (i) the disclosure does not violate any 

3 . limitations placed upon the use or disclosure 

4 of the information at the time the information 

5 was obtained, 

6 (ii) the project camiot reasonably be 

7 conducted without the information, and 

8 (iii) the importance of the project 

9 outweighs the risk to the individual that dis- 

10 closure might bring, 

11 (B) the person conducting the project pro- 

12 vides adequate assurances that — 

13 (i) appropriate safeguards will be estab- 

14 lished against unauthorized use or disclosure 

15 of the information, and 

16 (ii) there will be a program to remove 

17 or destroy materials enabUng the individual 

18 to be identified at the earliest time at which 

19 removal or destruction can be accomplished 

20 consistent with the purposes of the research, 

21 unless the recipient presents an adequate jus- 

22 tification of a research or health nature for 

23 retaining such materials, and 

24 (C) the person conducting the project pro- 

25 vides adequate assurances that further use or dis- 



45 



8 

1 closure of the information will not be made, 

2 except — 

3 (i) for disclosure to a person employed 

4 by, an agent of, or responsible to, the person 

5 conducting the project, to the extent needed 

6 to carry out the project, 

7 (ii) to the extent necessary to meet a 

8 medical emergency or to prevent a crime 

9 that could result in physical injury to an in- 

10 dividual, provided that the information dis- 

11 closed will be limited to that necessary to 

12 provide medical assistance or to secure the 

13 protection of the individual who may by 

14 injured, 

15 (iii) in compUance with a judicial order, 

16 including a search warrant or lawfully issued 

17 subpena, where the purpose of the judicial 

18 order is to assist inquiry into an alleged vio- 

19 lation of law by the person or agency main- 

20 taining research records: Provided, That — 

21 ^ (I) any information so disclosed 

22 shall not be used as evidence in any ad- 

23 ministrative, legislative, or judicial pro- 

24 ceeding against anyone other than the 

25 agency or person maintaining the 



46 



9 

1 record, their employees, or a person to 

2 whom the information was disclosed, 

3 (n) any information so disclosed 

4 shall not be used as evidence, or other- 

5 wise made public, in a manner that an 

6 individual to whom information in the 

7 research record pertains may be identi- 

8 fied, unless identification of the individ- 

9 ual is necessary to establish the viola- 

10 tion of law, and 

11 (ILL) an individual identified in any 

12 information to be made public in identi- 

13 fiable form shall be given notice prior to 

14 such publication and given an opportu- 

15 nity to contest the necessity of such 

16 publication, 

17 (iv) to qualified and properly identified 

18 persons for the purpose of conducting man- 

19 agement audits, financial audits, or program 

20 evaluation: Provided, That — 

21 (I) the audit or evaluation is au- 

22 thorized by statute if it is conducted by 

23 a Government authority, or authorized 

24 by statute or by contractual agreement 

25 if conducted by any other person, and 



47 



10 

1 (II) that no subsequent use or dis- 

2 closure of the information wall be made 

3 by the auditor or evaluator, except in 

4 accordance with this paragraph, and 

5 (v) for a research or statistics purpose: 

6 Provided, That the person or agency disclos- 

7 ing the records — 

8 (I) determines that such use or dis- 

9 closure does not violate any limitation 

10 under which the record or information 

11 was provided, collected, or obtained, 

12 (n) determines that the research 

13 or statistics purpose for which the dis- 

14 closure is to be made cannot be reason- 

15 ably accomplished unless the informa- 

16 tion is provided in individually identifi- 

17 able form, and warrants the risk to the 

18 individual that additional exposure of 

19 the information might bring, 

20 (IH) requires the recipient to es- 

21 tablish reasonable administrative, tech- 

22 nical, and physical safeguards to pre- 

23 vent unauthorized use or disclosure of 

24 research records, and to remove or de- 

25 stroy the information that allows the in- 



48 



11 

1 dividual to be identified at the earliest 

2 time at which removal or destruction 

3 can be accomplished consistent with the 

4 purpose of the research project, unless 

5 the recipient presents an adequate justi- 

6 fication of a research or health nature 

7 for retaining such materials, and 

8 (TV) secures a written statement 

9 attesting to the recipient's understand- 

10 ing of, and willingness to abide by, the 

11 conditions of this Act, 

12 (6) to persons presenting appropriate evidence of 

13 their official status who state in writing that they need 

14 the information — 

15 (A) for a Government public health investi- 

16 gation, for a Government investigation of activi- 

17 ties of the faciUty, or for a Federal, State, or local 

18 government audit or evaluation purposes, or 

19 (B) to carry out a program under title V, 

20 part B of title XI, title XVm, or title XIX of the 

21 Social Security Act, or other Government pro- 

22 gram providing payments to, or concerned with 

23 activities of, the facility, or to conduct an investi- 

24 gation concerning fraud, abuse, or waste under 

25 those programs. 



49 



12 

1 if a copy of the written statement is maintained and 

2 made available to the individual on request, 

3 (7) to persons v^^ho state in writing that they need 

4 the information for an audit or evaluation purpose, or 

5 for the purpose of carrying out a program providing 

6 payments to the facility, if — 

7 (A) the person to whom the mformation is to 

8 be disclosed provides adequate assurances that ap- 

9 propriate safeguards will be established against 

10 unauthorized disclosure of the information, and 

11 that there will be a program to remove or destroy 

12 materials enabling the individual to be identified, 

13 (B) the person to whom the information is to 

14 be disclosed provides adequate assurances that 

15 further use or disclosure of the information will 

16 not be made, except — 

17 (i) for disclosure to persons carrying out 

18 the audit or evaluation purpose, or carrying 

19 out the program providing pajmients, 

20 (ii) in compelling circumstances affecting 

21 the health or safety of the individual or an- 

22 other person, or 

23 (iii) pursuant to compulsory legal proc- 

24 ess, and 



50 



13 

1 (C) a copy of the written statement is main- 

2 tained and made available to the individual on 

3 request, 

4 (8) pursuant to a Federal or State law requiring 

5 disclosure to a pubHc health authority, 

6 (9) to a law enforcement authority, pursuant to a 

7 Federal or State law that requires specific types of in- 

8 formation to be reported to that authority, 

9 (10) revealing only the presence of the individual 

10 at the facility at a particular time or the provision of 

11 services at a particular time to the individual, his loca- 

12 tion, or his general medical condition, if — 

13 (A) the individual has not objected to the dis- 

14 closure, or 

15 (B) the disclosure is to a Government au- 

16 thority pursuant to a legitimate law enforcement 

17 inquiry, 

18 (11) to a Federal authority pursuant to an admin- 

19 istrative summons or subpena, search warrant, judicial 

20 subpena, or formal written request of the Federal au- 

21 thority, if the Federal authority certifies in writing to 

22 the facility that the Federal authority has complied 

23 with the applicable requirements of sections 203 

24 through 206, 



51 



14 

1 (12) to a State authority pursuant to an adminis- 

2 trative summons or subpena, search warrant, judicial 

3 subpena, or formal written request of the State author- 

4 ity, if, at the time of the request, the State authority 

5 certifies in writing to the facility that the State author- 

6 ity has complied with the applicable requirements 

7 under section 207, 

8 (13) to a Government authority, if, at the time of 

9 disclosure or as soon thereafter as practical, the au- 

10 thority certifies in writing to the facility, in a document 

11 signed by a supervisory official of a rank designated by 

12 the head of the Government authority, that the infor- 

13 mation is immediately needed to prevent the imminent 

14 danger of — 

15 (A) serious property damage, or 

16 (B) flight to avoid prosecution, 

17 (14) to a Government authority, if the authority 

18 seeks the information under the Federal Rules of Civil 

19 or Criminal Procedure or comparable rules of State 

20 courts in connection with litigation to which the Gov- 

21 emment authority and the individual are parties, 

22 (15) to a Government authority, if the authority 

23 seeks the information pursuant to an administrative 

24 subpena issued by an administrative law judge or com- 

25 parable State official in an adjudicatory proceeding 



52 



15 

1 subject to section 554 of title 5, United States Code, 

2 or comparable provisions of State law to which the 

3 Government authority and the individual are parties, 

4 (16) to— 

5 (A) a Federal authority authorized to conduct 

6 foreign intelligence or counterintelligence activi- 

7 ties, if the Federal authority certifies in writing to 

8 the facihty, in a document signed by a supervisory 

9 official of a rank designated by the head of the 

10 Federal authority, that the information is needed 

11 to accomplish a purpose of conducting such activi- 

12 ties, or 

13 (B) to the Secret Service, if the Secret Serv- 

14 ice certifies in writing to the facility, in a docu- 

15 ment signed by a supervisory official of a rank 

16 designated by the Secretary of the Treasury, that 

17 the information is needed to accomphsh the pur- 

18 pose of conducting the protective functions of the 

19 Secret Service: 

20 Provided, That no medical care facility, or officer, 

21 agent, or employee of such facility, shall disclose to 

22 any person that an inquiry made pursuant to this para- 

23 graph occurred or that information was disclosed pur- 

24 suant to this paragraph and no record of such inquiry 

25 or disclosure shall be included as part of the medical 



53 



16 

1 information that the facility maintains concerning the 

2 individual, 

3 (17) of medical information pertaining to a 

4 member of the uniformed services in materials belong- 

5 ing to any of the uniformed services (as defined in 37 

6 U.S.C. 101(3)), to a uniformed services authority, 

7 (18) of medical information in materials belonging 

8 to a penal or correctional authority, to the penal or 

9 correctional authority or to another judicial or execu- 

10 tive agency, for purposes of parole, probation, pardon, 

11 or commutation of sentence, or judicial review, or to a 

12 law enforcement authority for the purpose of investi- 

13 gating an offense committed in the facility of the penal 

14 or correctional authority, 

15 (19) pursuant to a subpena or court order issued 

16 in connection with proceedings before a grand jury, 

17 (20) to a person other than a Government author- 

18 ity pursuant to compulsory legal process, 

19 (21) of medical information in materials belonging 

20 to or in the custody of the Veterans' Administration or 

21 its contractors or any of the uniformed services, to a 

22 Veterans' Administration authority or contractor there- 

23 of for the purpose of determining or providing benefits 

24 under title 38, United States Code, or 



54 



17 

1 (22) to a Government authority, or to a third 

2 party potentially liable or responsible to the medical 

3 care facility for the cost of providing services to an in- 

4 dividual, for the purpose of and to the extent necessary 

5 for processing a claim related to medical services re- 

6 ceived by an individual. 

7 (c) An appropriate United States district court, or any 

8 other court of competent jurisdiction, may grant one or more 

9 delays of not greater than thirty days each with respect to 

10 making a written statement available to the individual under 

11 subsection (b) (6) or (7) if the court finds that there is reason 

12 to believe that the delay is needed to prevent — 

13 (A) endangering the life or physical safety of any 

14 person, 

15 (B) flight from prosecution, 

16 (C) destruction of or tampering with evidence, 

17 (D) intimidation of potential witnesses, or 

18 (E) otherwise seriously jeopardizing an investiga- 

19 tion or official proceeding or unduly delaying a trial or 

20 ongoing official proceedings to the same extent as the 

21 circumstances in the preceding subparagraphs. 

22 An application for delay must be made with reasonable speci- 

23 ficity. 

24 (d) An authorization by the individual for disclosure re- 

25 ferred to in subsection (a) shall — 



55 

18 

1 (1) be in writing, 

2 (2) be dated, 

3 (3) be signed by the individual, 

4 (4) make clear that the medical care facility is 

5 among those either specifically named or generically 

6 designated by the individual as authorized to disclose 

7 information concerning the individual, 

8 (5) be specific as to the nature of the information 

9 authorized to be disclosed, 

10 (6) state specifically named or generically desig- 

11 nated persons to whom the information may be dis- 

12 closed, 

13 (7) specifically state the expiration date or event 

14 of the authorization. 

15 An authorization may be revoked in whole or in part at any 

16 time. 

17 (e) A medical facility which discloses medical informa- 

18 tion that it maintains concerning an individual pursuant to an 

19 authorization specified in subsection (d) shall make a copy of 

20 the authorization part of the medical information that it 

21 maintains concerning the individual. 

22 COMPLIANCE WITH THIS ACT AS A CONDITION FOR 

23 RECEIPT OF CERTAIN FEDERAL FUNDS 

24 Sec. 106. (a) A medical care facility may not continue 

25 to participate in or be covered under a program under title 



56 

19 

1 XV ILL or XIX of the Social Security Act, or to receive funds 

2 from appropriations authorized by the Public Health Service 

3 Act, title V of the Social Security Act, the Community 

4 Mental Health Centers Act, the Comprehensive Alcohol 

5 Abuse and Alcoholism Prevention, Treatment, and Rehabili- 

6 tation Act of 1970, or the Drug Abuse Office and Treatment 

7 Act of 1972, unless the facility provides adequate assurances, 

8 and evidence from time to time as required by the Secretary, 

9 of its substantial compliance with the requirements of sec- 

10 tions 101 through 105. 

11 DUTY OF INSTITUTIONAL REVIEW BOARD 

12 Sec. 107. If an institutional review board undertakes to 

13 determine whether medical information maintained by a 

14 medical care facility may be disclosed because the disclosure 

15 would not violate section 104 and would meet the require- 

16 ments of section 105(b)(5), it shall make that determination in 

17 a manner which is neither arbitrary nor capricious. 

18 MEDICAL INFORMATION COMPILED SOLELY FOR CIVIL 

19 LITIGATION 

20 Sec. 108. Sections 101 and 102 of this title shall not 

21 apply to any medical information that the facility maintains 

22 concerning the individual which is compiled solely in reason- 

23 able anticipation of a civil action or proceeding. 



57 

20 

1 MEDICAL INFORMATION HELD BY PENAL AND 

2 CORRECTIONAL AUTHORITIES 

3 Sec. 109. Nothing in this title except section 105 shall 

4 apply to medical information in materials belonging to any 

5 penal or correctional authority. 

6 TITLE n— REQUIREMENTS APPLICABLE TO 

7 GOVERNMENT AUTHORITIES 

8 ACCESS BY GOVERNMENT AUTHORITIES TO MEDICAL 

9 INFORMATION MAINTAINED BY HEALTH CARE 

10 PROVIDERS 

11 Sec. 201. a Government authority may have access to, 

12 or obtain copies of, medical information concerning an indi- 

13 vidual maintained by a health care provider only through 

14 properly identified persons presenting appropriate evidence of 

15 their official status, and only to the extent needed to accom- 

16 plish the purpose for which the disclosure is to be made. 

17 CONDITIONS FOR ACCESS BY GOVERNMENT AUTHORITIES 

18 TO MEDICAL INFORMATION MAINTAINED BY HEALTH 

19 CARE PROVIDERS 

20 Sec. 202. A Government authority may have access to, 

21 or obtain copies of, medical information concerning an indi- 

22 vidual maintained by a health care provider only if the infor- 

23 mation is reasonably described and — 

24 (1) the individual has authorized the disclosure as 

25 provided in section 105(d), 



58 



21 

1 (2) is needed by a person employed by, an agent 

2 of, or responsible to, the health care provider, to carry 

3 out his duties, 

4 (3) is needed by another health care provider, in 

5 connection with health services being provided to the 

6 individual, 

7 (4) is needed in compelling circumstances which 

8 the facility has in good faith determined will affect the 

9 health or safety of the individual or another person, 

10 (5) is to be used in a biomedical, epidemiologic, or 

11 health services research project, if the conditions set 

12 forth in section 105(b)(5) are met, 

13 (6) is needed— 

14 (A) for a pubHc health investigation, for an 

15 investigation of activities of the health care pro- 

16 vider, or for an audit or evaluation purpose, or 

17 (B) to carry out a program under title V, 

18 part B of title XI, title XVm, or title XIX of the 

19 Social Security Act, or other program providing 

20 payments to, or concerned with activities of, the 

21 health care provider, or to conduct an investiga- 

22 tion concerning fraud, abuse, or waste under 

23 those programs, 



59 



22 

1 (7) is reported to a public health authority pursu- 

2 ant to a Federal or State law requiring disclosure to a 

3 public health authority, 

4 (8) is reported to a law enforcement authority, 

5 pursuant to a Federal or State law that requires specif- 

6 ic types of information to be reported to that authority, 

7 (9) reveals only the presence of the individual at 

8 the facility at a particular time or the provision of 

9 services at a particular time to the individual, his loca- 

10 tion, or his general medical condition, if — 

11 (A) the individual has not objected to the dis- 

12 closure, or 

13 (B) the disclosure is pursuant to a legitimate 

14 law enforcement inquiry, 

15 (10) is sought by a Federal authority pursuant to 

16 an administrative summons or subpena, search war- 

17 rant, judicial subpena, or formal written request, if — 

18 (A) the Federal authority has complied with 

19 the applicable requirements of sections 203 

20 through 206, and 

21 (B) the Federal authority certifies in writing 

22 to the health care provider that the Federal au- 

23 thority has complied with the applicable require- 

24 ments of sections 203 through 206, 



60 



23 

1 (11) is sought by a State authority pursuant to an 

2 administrative summons or subpena, search warrant, 

3 judicial subpena, or formal written request, if — 

4 (A) the State authority has complied with 

5 the applicable requirements under section 207, 

6 and 

7 (B) the State authority certifies in writing to 

8 the health care provider that the State authority 

9 has complied with the appHcable requirements 

10 under section 207, 

11 (12) is immediately needed to prevent the immi- 

12 nent danger of — 

13 (A) serious property damage, or 

14 (B) flight to avoid prosecution, 

15 if, before the disclosure or as soon thereafter as practi- 

16 cal, the Government authority certifies in writing to 

17 the health care provider, in a document signed by a su- 

18 pervisory official of a rank designated by the head of 

19 the Government authority, that the information is 

20 needed for one of the two reasons specified in this 

21 paragraph, 

22 (13) is sought under the Federal Rules of Civil or 

23 Criminal Procedure or comparable rules of State courts 

24 in connection with litigation to which the Government 

25 authority and the individual are parties. 



61 



24 

1 (14) is sought pursuant to an administrative sub- 

2 pena issued by an administrative law judge or compa- 

3 rable State official in an adjudicatory proceeding sub- 

4 ject to section 554 of title 5, United States Code, or 

5 comparable provisions of State law to which the Gov- 

6 ernment authority and the individual are parties, 

7 (15)(A) is needed for a purpose of conducting for- 

8 eign intelligence or counterintelligence activities by a 

9 Federal authority authorized to conduct such activities, 

10 if the Federal authority certifies in writing to the 

11 health care provider, in a document signed by a super- 

12 visory official of a rank designated by the head of the 

13 Federal authority, that the information is needed to ac- 

14 complish that purpose, or 

15 (B) is needed by the Secret Service for the pur- 

16 pose of conducting its protective functions, if the 

17 Secret Service certifies in writing to the health care 

18 provider, in a document signed by a supervisory official 

19 of a rank designated by the Secretary of the Treasury, 

20 that the information is needed to accomplish that pur- 

21 pose: 

22 Provided, That no health care provider, or associate, employ- 

23 ee or agent of such provider, shall disclose to any person that 

24 an inquiry made pursuant to this paragraph occurred or that 

25 information was disclosed pursuant to this paragraph, and no 



62 



25 

1 record of such inquiry or disclosure shall be included as part 

2 of the medical information that the provider maintains con- 

3 cerning the individual, 

4 (16)(A) is in materials belonging to any of the uni- 

5 formed services (as defined in 37 U.S.C. 101(3)), and 

6 (B) is sought by a uniformed services authority, 

7 (17)(A) is in materials belonging to a penal or cor- 

8 rectional authority, and 

9 (B) is sought by the penal or correctional authori- 

10 ty, or by another judicial or executive agency, for pur- 

11 poses of parole, probation, pardon, or commutation of 

12 sentence, or judicial review, or by a law enforcement 

13 authority for the purpose of investigating an offense 

14 committed in a facility of the penal or correctional 

15 authority, 

16 (18) is sought pursuant to a subpena or court 

17 order issued in connection with proceedings before a 

18 grand jury, 

19 (19) is in materials belonging to the Veterans' 

20 Administration or its contractors and is sought by the 

21 Veterans' Administration or its contractor or any of 

22 the uniformed services for the purpose of determining 

23 or providing benefits under title 38, United States 

24 Code, or 



63 



26 

1 (20) is sought by a Federal Government authority 

2 for the purpose of and to the extent necessary for proc- 

3 essing a claim related to medical services received by 

4 an individual. 

5 FEDERAL ADMINISTEATIVE SUBPENA AND SUMMONS 

6 ■ Sec. 203. A Federal authority may obtain medical in- 

7 formation concerning an individual under section 202(10) 

8 pursuant to an administrative subpena or summons otherwise 

9 authorized by law only if — 

10 (1) there is reason to believe that the records 

11 sought are relevant to a legitimate law enforcement 

12 inquiry, 

13 (2) a copy of the subpena or summons has been 

14 served upon the individual or mailed to his last known 

15 address on or before the date on which the subpena or 

16 summons was served on the health care provider to- 

17 gether with the following notice which shall state v^ath 

18 reasonable specificity the nature of the law enforce- 

19 V ment inquiry: 

20 "Records or information concerning you held by 

21 the health care provider named in the attached sub- 

22 pena or summons are being sought by this (agency or 

23 department) in accordance with the Privacy of Medical 

24 Information Act for the follov^dng purpose: 



64 

27 

1 If you desire that such records or information not be 

2 made available, you must: 

3 "1. Fill out the accompan3dng motion paper 

4 and sworn statement or write one of your own, 

5 stating that you are the individual whose records 

6 are being requested by the Government and either 

7 giving the reasons you believe that the records 

8 are not relevant to the legitimate law enforcement 

9 inquiry stated in this notice or any other legal 

10 basis for objecting to the release of the records. 

11 "2. File the motion and statement by mailing 

12 or delivering them to the clerk of any one of the 

13 following United States district courts: 

14 "3. Serve the Government authority the rec- 

15 ords by mailing or delivering a copy of your 

16 motion and statement to 

17 "4. Be prepared to come to court and pres- 

18 ent your position in further detail. 

19 "5. You do not need to have a lawyer, al- 

20 though you may wish to employ one to represent 

21 you and protect your rights. 

22 If you do not follow the above procedures, upon the 

23 expiration of ten days from the date of service or four- 

24 teen days from the date of mailing of this notice, the 



65 

28 

1 records or information requested therein will be made 

2 available. These records may be transferred to other 

3 Government authorities for legitimate law enforcement 

4 inquiries, in which event you will be notified after the 

5 transfer.", and 

6 (3) ten days have expired from the date of service 

7 of the notice or fourteen days have expired from the 

8 date of mailing the notice to the individual and within 

9 such time period the individual has not filed a sworn 

10 statement and motion to quash in an appropriate court, 

11 or the challenge provisions of section 209 have been 

12 com.plied with. 

13 FEDERAL SEAECH WARRANTS 

14 Sec. 204. (a) A Federal authority may obtain medical 

15 information concerning an individual under section 202(10) 

16 pursuant to a search warrant only if it obtains a search war- 

17 rant pursuant to the Federal Rules of Criminal Procedure. 

18 (b) No later than ninety days after the Federal authority 

19 serves the search warrant, it shall mail to the individual's 

20 last known address a copy of the search warrant together 

21 with the following notice: 

22 "Records or information concerning you held by the 

23 health care provider named in the attached search warrant 

24 were obtained by this (agency or department) on (date) for 



66 

29 

1 the following purpose: . You may have rights 

2 under the Privacy of Medical Information Act.". 

3 FEDERAL JUDICIAL SUBPENA 

4 Sec. 205. A Federal authority may obtain medical in- 

5 formation concerning an individual under section 202(10) 

6 pursuant to a judicial subpena only if — 

7 (1) such subpena is authorized by law and there is 

8 reason to believe that the records sought are relevant 

9 to a legitimate law enforcement inquiry, 

10 (2) a copy of the subpena has been served upon 

11 the individual or mailed to his last known address on 

12 or before the date on which the subpena was served on 

13 the health care provider together vdth the following 

14 notice which shall state with reasonable specificity the 

15 nature of the law enforcement inquiry: 

16 "Records or information concerning you which 

17 are held by the health care provider named in the at- 

18 tached subpena are being sought by the (agency or de- 

19 partment) in accordance with the Privacy of Medical 

20 Information Act for the following purpose: 

21 If you desire that such records or information not be 

22 made available, you must: 

23 "1. Fill out the accompanying motion paper 

24 and sworn statement or write one of your own, 

25 stating that you are the individual whose records 



67 

30 

1 are being requested by the Government and either 

2 giving the reasons you believe that the records 

3 are not relevant to the legitimate law enforcement 

4 inquiry stated in this notice or any other legal 

5 basis for objecting to the release of the records. 

6 "2. File the motion and statement by mailing 

7 or delivering them to the clerk of the 

8 court. 

9 "3. Serve the Government authority request- 

10 ing the records by mailing or delivering a copy of 

11 your motion and statement to 

12 "4. Be prepared to come to court and pres- 

13 ent your position in further detail. 

14 "5. You do not need to have a lawyer, al- 

15 though you may wish to employ one to represent 

16 you and protect your rights. 

17 If you do not follow the above procedures, upon the 

18 expiration of ten days from the date of service or four- 

19 teen days from the date of mailing of this notice, the 

20 records or information requested therein will be made 

21 available. These records may be transferred to other 

22 Government authorities for legitimate law enforcement 

23 inquiries, in which event you vdll be notified after the 

24 transfer.", and 



68 



31 

1 (3) ten days have expired from the date of service 

2 or fourteen days from the date of mailing of the notice 

3 to the individual and within such time period the indi- 

4 vidual has not filed a sworn statement and motion to 

5 quash in an appropriate court, or the challenge provi- 

6 sions of section 209 have been complied with. 

7 FEDERAL FORMAL WRITTEN REQUEST 

8 Sec. 206. A Federal authority may request medical in- 

9 formation concerning an individual under section 202(10) 

10 pursuant to a formal written request only if — 

11 (1) no administrative summons or subpena author- 

12 ity reasonably appears to be available to the Federal 

13 authority to obtain medical information for the purpose 

14 for which such information is sought, 

15 (2) the request is authorized by regulations pro- 

16 mulgated by the head of the agency or department, 

17 (3) there is reason to believe that the medical in- 

18 formation sought is relevant to a legitimate law en- 

19 forcement inquiry, and 

20 (4)(A) a copy of the request has been served upon 

21 the individual or mailed to his last known address on 

22 or before the date on which the request was made to 

23 the health care provider together with the following 

24 notice which shall state with reasonable specificity the 

25 nature of the law enforcement inquiry: 



69 



32 

1 "Records or information concerning you held by 

2 the health care provider named in the attached request 

3 are being sought by this (agency or department) in ac- 

4 cordance with the Privacy of Medical Information Act 

5 for the following purpose: . If you 

6 desire that such records or information not be made 

7 available, you must: 

8 "1. Fill out the accompanying motion paper 

9 and sworn statement or write one of your own, 

10 stating that you are the individual whose records 

11 are being requested by the Government and either 

12 giving the reasons you believe that the records 

13 are not relevant to the legitimate law enforcement 

14 inquiry stated in this notice or any other legal 

15 basis for objecting to the release of the records. 

16 "2. File the motion and statement by mailing 

17 or delivering them to the clerk of any one of the 

18 following United States district courts: 

19 "3. Serve the Government authority request- 
20- ing the records by mailing or delivering a copy of 

21 your motion and statement to 

22 "4. Be prepared to come to court and pres- 

23 ent your position in further detail. 



70 



33 

1 "5. You do not need to have a lawyer, al- 

2 though you may wish to employ one to represent 

3 you and protect your rights. 

4 If you do not follow the above procedures, upon the 

5 expiration of ten days from the date of service or four- 

6 teen days from the date of mailing of this notice, the 

7 records or information requested therein may be made 

8 available. These records may be transferred to other 

9 Government authorities for legitimate law enforcement 

10 inquiries, in which event you will be notified after the 

11 transfer.", and 

12 (B) ten days have expired from the date of service 

13 or fourteen days from the date of mailing of the notice 

14 to the individual and within such time period the indi- 

15 vidual has not filed a sworn statement and an applica- 

16 tion to enjoin the Government authority in an appro- 

17 priate court, or the challenge provisions of section 209 

18 have been complied Mdth. 

19 STATE ADMINISTRATIVE SUMMONS AND SUBPENA, 

20 SEARCH WARRANT, JUDICIAL SUBPENA, AND FORMAL 

21 WRITTEN REQUEST 

22 Sec. 207. A state authority may obtain medical infor- 

23 mation concerning an individual under section 202(11) only if 

24 the State authority complies with the applicable requirements 

25 of sections 203 through 206 as they would apply to a Federal 



71 

34 

1 authority, except that, for purposes of this section, references 

2 in sections 203 through 206 to a Federal court, procedure, or 

3 other matter shall refer to an appropriate State court, proce- 

4 dure, or other matter, or, if the State authority so chooses, to 

5 the Federal court, procedure, or other matter. 

6 DELAYED NOTICE — PRESERVATION OF RECORDS 

7 Sec. 208. (a) Upon application of the Government au- 

8 thority, a notice required under section 203(2), 204(b), 

9 205(2), 206(4), 207, or 211(b) may be delayed by order of an 

10 appropriate court if the presiding judge or magistrate finds 

11 that— 

12 (1) the investigation being conducted is within the 

13 lawful jurisdiction of the Government authority seeking 

14 the medical information, 

15 (2) there is reason to believe that the medical in- 

16 formation being sought is relevant to a legitimate law 

17 enforcement inquiry, and 

18 (3) there is reason to believe that such notice will 

19 result in — 

20 (A) endangering the life or physical safety of 

21 any person, 

22 (B) flight from prosecution, 

23 (C) destruction of or tampering with evi- 

24 dence, 

25 (D) intimidation of potential witnesses, or 



72 



35 

1 (E) otherwise seriously jeopardizing an inves- 

2 ligation or official proceeding or unduly delaying a 

3 trial or ongoing official proceeding to the same 

4 extent as the circumstances in the preceding sub- 

5 paragraphs. 

6 An application for delay must be made with reasonable speci- 

7 ficity. 

8 (b)(1) If the court makes the findings required in para- 

9 graphs (1), (2), and (3) of subsection (a), it shall enter an ex 

10 parte order granting the requested delay for a period not to 

11 exceed ninety days and shall issue an order prohibiting the 

12 health care provider from disclosing that confidential informa- 

13 tion has been obtained or that a request for confidential infor- 

14 mation has been made, except that, if the court finds that 

15 there is reason to believe that such notice may endanger the 

16 lives or physical safety of a patient or former patient or group 

17 of patients, or any person or group of persons associated with 

18 a patient or former patient, the court may specify that the 

19 delay be indefinite. 

20 (2) Extensions of the delay of notice provided in para- 

21 graph (1) of up to ninety days each may be granted by the 

22 court upon application, but only in accordance with this sub- 

23 section. 

24 (3) Upon expiration of the period of delay of notification 

25 under paragraph (1) or (2), the individual shall be served with 



73 



36 

1 or mailed a copy of the process or request, together with the 

2 following notice which shall state with reasonable specificity 

3 the nature of the law enforcement inquiry: 

4 "Records or information concerning you which are held 

5 by the health care provider named in the attached process or 

6 request were supplied to or requested by the Government 

7 authority named in the process or request on (date). Notifica- 

8 tion was withheld pursuant to a determination by the (title of 

9 court so ordering) under the Privacy of Medical Information 

10 Act that such notice might (state reason). The purpose of the 

11 investigation or official proceeding was (state purpose).". 

12 (c) When access to medical information is obtained pur- 

13 suant to section 202(12) (emergency access), the Government 

14 authority shall, unless a court has authorized delay of notice 

15 pursuant to subsections (a) and (b), as soon as practicable 

16 after such records are obtained serve upon the individual, or 

17 mail by registered or certified mail to his last known address, 

18 a copy of the request to the health care provider together 

19 with the following notice which shall state with reasonable 

20 specificity the nature of the law enforcement inquiry: 

21 "Records concerning you held by the health care pro- 

22 vider named in the attached request were oBtained by 

23 (agency or department) under the Privacy of Medical Infor- 

24 mation Act on (date) for the following purpose: 



74 



37 

1 Emergency access to such records was obtained on the 

2 grounds that (state grounds).", 

3 (d) Any memorandum, affidavit, or other paper filed in 

4 connection with a request for delay in notification shall be 

5 preserved by the court. Upon petition by the individual to 

6 whom such papers pertain, the court may order disclosure of 

7 such papers to the petitioner unless the court makes the find- 

8 ings required in subsection (a). 

9 CHALLENGE PROVISIONS 

10 Sec. 209. (a) Within ten days of service or within four- 

11 teen days of mailing of a summons, subpena, or formal writ- 

12 ten request, an individual may file a motion to quash the 

13 summons or subpena, or an application to enjoin a Govern- 

14 ment authority from obtaining medical information concern- 

15 ing him pursuant to the formal written request, with copies 

16 served upon the Government authority. No filing fee shall be 

17 required. A motion to quash a judicial subpena shall be filed 

18 in the court which issued the subpena. A motion to quash an 

19 administrative summons or subpena or an application to 

20 enjoin a Government authority from obtaining medical infor- 

21 mation pursuant to a formal written request, shall be filed in 

22 the appropriate court. Such motion or application shall con- 

23 tain an affidavit or sworn statement — 

24 (1) stating that the applicant believes the health 

25 care provider from which the medical information is 



75 

38 

1 sought maintains medical information concerning the 

2 individual, and 

3 (2) stating the applicant's reasons for believing 

4 that the medical information sought is not relevant to 

5 the legitimate law enforcement inquiry stated by the 

6 Government authority in its notice, or that there has 

7 not been substantial compliance with the provisions of 

8 this title. 

9 Service shall be made under this section upon a Government 

10 authority by delivering or mailing by registered or certified 

11 mail a copy of the papers to the person, office, or department 

12 specified in the notice which the individual has received pur- 

13 suant to this title. For the purposes of this section, "deliv- 

14 ery" has the meaning stated in rule 5(b) of the Federal Rules 

15 of Civil Procedure or comparable rules of State Courts. 

16 (b) If the court finds that the individual has complied 

17 with subsection (a), it shall order the Government authority 

18 to file a sworn response, which may be filed in camera if the 

19 Government authority includes in its response the reasons 

20 which make in camera review appropriate. If the court is 

21 unable to determine the motion or application on the basis of 

22 the parties' initial allegations and response, the court may 

23 conduct such additional proceedings as it deems appropriate. 

24 All such proceedings shall be completed and the motion or 



76 

39 

1 application decided within seven calendar days of the filing of 

2 the Government authority's response, 

3 (c) If the court finds that the medical information is 

4 medical information concerning that individual, and that 

5 there is a demonstrable reason to believe that the law en- 

6 forcement inquiry is legitimate, a reasonable belief that the 

7 medical information sought is relevant to that inquiry, and 

8 that there has been substantial compliance with the provi- 

9 sions of this Act, it shall deny the motion or application, and, 

10 in the case of an administrative summons or court order other 

11 than a search warrant, order such process enforced. If the 

12 court finds that the medical information is medical informa- 

13 tion concerning that individual, and that there is not a de- 

14 monstrable reason to beheve that the law enforcement in- 

15 quiry is legitimate, or there is not a reasonable belief that the 

16 medical information sought is relevant to that inquiry, or 

17 there has not been substantial comphance with the provisions 

18 of this Act, it shall order the process quashed or shall enjoin 

19 the Government authority's formal written request. 

20 (d) A court ruling denying a motion or application under 

2 1 this section shall not be deemed a final order and no interloc- 

22 utory appeal may be taken therefrom by the individual. An 

23 appeal of a ruHng denying a motion or application under this 

24 section may be taken by the individual (1) within such period 

25 of time as provided by law as part of any appeal from a final 



77 

40 

1 order in any legal proceeding initiated against him arising out 

2 of or based upon the medical information, or (2) within thirty 

3 days after a notification that no legal proceeding is contem- 

4 plated against him. The Government authority obtaining the 

5 medical information shall promptly notify an individual when 

6 a determination has been made that no legal proceeding 

7 against him is contemplated. After one hundred and eighty 

8 days from the denial of the motion or application, if the Gov- 

9 ernment authority obtaining the medical information has not 

10 initiated such a proceeding, a supervisory official of the Gov- 

11 ernment authority shall certify to the appropriate court that 

12 no such determination has been made. The court may require 

13 that such certifications be made, at reasonable intervals 

14 thereafter, until either notification to the individual has oc- 

15 curred or a legal proceeding is initiated as described in clause 

16 (1). 

17 (e) The challenge procedures of this title constitute the 

18 sole judicial remedy available to an individual to oppose dis- 

19 closure of medical information pursuant to section 202(10). 

20 USE OF INFORMATION 

21 Sec. 210. (a) Medical information originally obtained 

22 under section 202 (10), (11), or (12) may be transferred only 

23 to another Government authority, and only if the transferring 

24 authority certifies in writing that there is reason to believe 

25 that the information is relevant to a legitimate law enforce- 



78 



41 

1 ment inquiry within the jurisdiction of the receiving 

2 authority. 

3 (b) When medical information subject to this Act is 

4 transferred pursuant to subsection (a), the transferring au- 

5 thority shall, within fourteen days, send to the individual a 

6 copy of the certification made pursuant to subsection (a) and 

7 the following notice, which shall state the nature of the law 

8 enforcement inquiry with reasonable specificity: "Copies of, 

9 or information contained in, your medical records lawfully in 

10 possession of have been furnished to 

1 1 pursuant to the Privacy of Medical Information Act for the fol- 

12 lowing purpose: . If you believe that this 

13 transfer has not been made to further a legitimate law en- 

14 forcement inquiry, you may have legal rights under that 

15 Act.". 

16 (c) Notwithstanding subsection (b), notice to the individ- 

17 ual may be delayed if the transferring authority has obtained 

18 a court order delaying notice pursuant to section 208 (a) and 

19 (b) and that order is still in effect, or if the receiving authority 

20 obtains a court order authorizing a delay in notice pursuant 

21 to section 208 (a) and (b). Upon the expiration of any such 

22 period of delay, the transferring authority shall serve to the 

23 individual the notice specified in subsection (b) above and the 

24 authority that obtained the court order authorizing a delay in 



79 

42 

1 notice pursuant to section 208 (a) and (b) shall serve to the 

2 individual the notice specified in section 208(b). 

3 ADDITIONAL REQUIREMENTS FOR GOVERNMENT 

4 AUTHORITIES 

5 Sec. 211. (a) Within five days of obtaining access to 

6 medical information under section 202(12), the Government 

7 authority shall file with the appropriate court a signed, sworn 

8 statement of a supervisory official of a rank designated by the 

9 head of the Government authority setting forth the grounds 

10 for the emergency access. 

11 (b) Each Federal authority obtaining access to medical 

12 information under section 202 (12) or (15) shall compile an 

13 annual tabulation of the occasions on which access was ob- 

14 tained under those provisions. 

15 (c) Unless otherwise provided by law, a Federal authori- 

16 ty shall pay to the health care provider assembling or provid- 

17 ing medical information concerning an individual under sub- 

18 section (b)(ll), (b)(13), (b)(16), or (d) of section 105, a fee for 

19 reimbursement for such costs as are reasonably necessary 

20 and which have been directly incurred in searching for, re- 

21 producing, or transporting books, papers, records, or other 

22 data required or requested to be produced. The Secretary 

23 shall, by regulation, establish the rates and conditions under 

24 which such payment shall be made. 



80 



43 

1 GRAND JURY INFORMATION 

2 Sec. 212. Medical information concerning an individual 

3 obtained from a health care provider pursuant to a subpena 

4 issued under the authority of a grand jury — 

5 (1) shall be returned and actually presented to the 

6 grand jury, 

7 (2) shall be used only for the purpose of consider- 

8 ing whether to issue an indictment or presentment by 

9 the grand jury, or of prosecuting a crime for which 

10 that indictment or presentment is issued, or for a pur- 

11 pose authorized by rule 6(e) of the Federal Rules of 

12 Criminal Procedure or comparable rules of State 

13 courts, 

14 (3) shall be destroyed or returned to the health 

15 care provider if not used for one of the purposes speci- 

16 fied in clause (2), and 

17 (4) shall not be maintained (and a description of 

18 the contents of the information shall not be maintained) 

19 by any Government authority other than in the sealed 

20 records of the grand jury, unless those records have 

21 been used in the prosecution of a crime for which the 

22 grand jury issued an indictment of presentment or for a 

23 purpose authorized by rule 6(e) of the Federal Rules of 

24 Criminal Procedure of comparable rules of State 

25 courts. 



ai 



44 

1 TITLE m— GENERAL PROVISIONS 

2 OBTAINING MEDICAL INFORMATION THROUGH DECEPTION 

3 Sec. 301. Any person who, under false pretenses, re- 

4 quests or obtains medical information concerning an individu- 

5 al from a health care provider shall be guilty of a misdemean- 

6 or and upon conviction thereof shall be fined not more than 

7 $10,000 or imprisoned for not more than one year, or both. 

8 CIVIL SUITS 

9 Sec. 302. (a) Any person aggrieved by — 

10 (1) a violation by a medical care facility of any 

11 provision of sections 101 through 105, 

12 (2) a violation by an institutional review board of 

13 section 107, 

14 (3) a violation by a Government agency of any 

15 provision of section 201, 202, 208, 210, 211, or 212, 

16 (4) the commission of acts which constitute a 

17 crime under section 301, or 

18 (5) a violation by a researcher of any provision of 

19 section 105(b)(5), 

20 may bring a civil action in any appropriate United States 

21 district court, without regard to the amount in controversy, 

22 or in any other court of competent jurisdiction. No such 

23 action shall be brought later than two years from the date of 

24 the discovery of the violation. 

25 (b) A civil action under subsection (a) may be brought — 



82 



45 

1 (1) in the case of a violation under paragraph (1) 

2 of subsection (a), against the medical care facility, 

3 (2) in the case of a violation under paragraph (2) 

4 of subsection (a), against the parent entity of the insti- 

5 tutional review board, 

6 (3) in the case of a violation under paragraph (3) 

7 of subsection (a) — 

8 (A) against the United States, 

9 (B) against a State which has waived its sov- 

10 ereign immunity under the Constitution, 

11 (C) against an officer or employee of a State 

12 which has not waived its sovereign immunity, or 

13 (D) against any other Government authority, 

14 (4) in the case of the commission of acts under 

15 paragraph (4) of subsection (a), against the person or 

16 persons who committed the acts, or 

17 (5) in the case of a violation by a researcher 

18 under paragraph (5) of subsection (a), against the 

19 researcher. 

20 A violator shall be liable to the aggrieved individual for all 

21 actual damages sustained by the individual. 

22 (c) In addition to actual damages awarded under subsec- 

23 tion (a), any medical care facility, parent entity of an institu- 

24 tional review board, government authority, or researcher that 

25 violates any provision of section 104 or 105 or title 11 of this 



83 



46 

1 Act shall be liable to the aggrieved individual for such gener- 

2 al damages as the court may allow, but not less than $100 

3 nor more than $10,000. In determining the amount of gener- 

4 al damages, the court shall consider, among other relevant 

5 factors, the amount of any actual damages awarded and the 

6 nature and seriousness of any intangible harm suffered by the 

7 individual. 

8 (d) Upon application by an aggrieved individual the ap- 

9 propriate United States district court or any other court of 

10 competent jurisdiction may grant such equitable and declara- 

11 tory reUef as is necessary to enforce the requirements im- 

12 posed under this Act. 

13 (e) In a successful action brought under this section, the 

14 costs of the action, together with reasonable attorneys' fees 

15 as determined by the court, may be awarded in addition to 

16 any damages. 

17 (0 It shall be a defense to an action brought against a 

18 medical care facility or researcher under subsection (a)(1) for 

19 a violation of section 104 or 105(a) that an institutional 

20 review board determined that the disclosure involved violated 

21 neither section 104, nor section 105(a) because of the appU- 

22 cability of section 105(b)(5). 

23 SUSPENSION OF FEDERAL STATUTES OF LIMITATIONS 

24 Sec. 303. If any individual files a motion or application 

25 under this Act which has the effect of delaying the access of 



84 



47 

1 a Federal authority to medical information concerning the 

2 individual, any applicable statute of limitations shall be 

3 deemed to be tolled for the period extending from the date 

4 such motion or application was filed until the date upon 

5 which the motion or application is decided. 

6 DISCLOSURE OF SUEVEYS OF COAJPLIANCE 

7 Sec. 304. (a) Any limitation in section 1106 of the 

8 Social Security Act concerning the disclosure of information 

9 shall not apply to information (except for medical information 

10 concerning an individual) contained in surveys of compliance 

11 with the provisions of this part conducted by or for the 

12 Secretary. 

13 (b) If the Secretary enters into a contract for conducting 

14 a survey of compliance with the provisions of this Act, the 

15 contract shall require the contractor to make available to the 

16 Secretary and for public inspection all information (except 

17 medical information concerning an individual) obtained for, 

18 and any reports resulting from, that survey. 

19 REGULATIONS 

20 Sec. 305. The Secretary may prescribe regulations to 

21 carry out the provisions of this Act. 

22 RECORDS 

23 Sec 306. Each Federal authority that requests access 

24 to medical information concerning an individual from a health 

25 care provider pursuant to section 202 (10), (12), or (15) shall 



85 



48 

1 maintain records describing each such request. Those records 

2 shall include the number of requests for medical information 

3 made pursuant to each provision of this Act listed in the pre- 

4 ceding sentence and the reason for each such request. 

5 AMENDMENTS TO FEDERAL AGENCY PRIVACY PROVISIONS 

6 Sec. 307. Section 552a of title 5, United States Code, 

7 is amended — 

8 (1) in subsection (a)(4), by inserting before the 

9 semicolon the following: ", except that, for purposes of 

10 subsections (b) and (d), paragraphs (3)(C), (4)CD), and 

11 (8) of subsection (e), and paragraphs (3) and (4) of sub- 

12 section (0, the term does not include medical informa- 

13 tion concerning an individual (as defined by section 

14 310(1) of the Privacy of Medical Information Act) 

15 maintained by a medical care facility (as defined by 

16 section 310(2) of that Act)", and 

17 (2) in subsection (i)(l), by striking out "or by rules 

18 or regulations established thereunder" and inserting in- 

19 stead "or by the Privacy of Medical Information Act, 

20 or by rules or regulations established under that Act or 

21 this section". 

22 effect on other laws 

23 Sec. 308. This part shall override State and other Fed- 

24 eral laws only to the extent that those laws are inconsistent 

25 with the provisions of this part. Nothing in this Act shall 



86 

49 

1 enlarge or restrict any rights of a health care provider to 

2 challenge requests for records made by a Federal authority 

3 under existing law. 

4 CONTINUED APPLICABILITY OF ACT 

5 Sec. 309. If a facility ceases to be a medical care facili- 

6 ty, the provisions of this Act shall continue to apply to medi- 

7 cal information concerning an individual maintained by the 

8 facility before it ceased to be a medical care facility. 

9 DEFINITIONS AND RELATED MATTERS 

10 Sec. 310. For purposes of this Act — 

11 (1) "medical information" concerning an individu- 

12 al means materials that — 

13 (A)(i) contain information relating to the 

14 health, examination, care, or treatment of the in- 

15 dividual, or (ii) are to be added to such materials 

16 under provisions of this Act, and 

17 (B) are in a form enabling the individual to 

18 be identified, 

19 (2) "medical care facility" means any facility (in- 

20 eluding any Federal facility, but excluding any State or 

21 local government facility that does not receive any 

22 Federal funds after the effective date of this Act) that 

23 is primarily engaged in providing — 

24 (A) to inpatients (i) diagnostic services and 

25 therapeutic services for medical diagnosis, treat- 



87 



50 

1 ment, and care of injured, disabled, or sick indi- 

2 viduals, or (ii) rehabilitation services for the reha- 

3 bilitation of injured, disabled, or sick individuals, 

4 (B) health-related services to individuals in 

5 the facility who because of their mental or physi- 

6 cal condition require such services (above the 

7 level of room and board), or 

8 (C) health-related services to outpatients, if 

9 (i) the facility is receiving funds from appropri- 

10 ations authorized by the Public Health Service 

11 Act, title V of the Social Security Act, the Com- 

12 munity Mental Health Centers Act, the Compre- 

13 hensive Alcoholism Abuse and Alcoholism Pre- 

14 vention, Treatment, and Rehabilitation Act of 

15 1970, or the Drug Abuse Office and Treatment 

16 Act of 1972, and (ii) the facility is made subject 

17 to the provisions of this Act by regulations of the 

18 Secretary, 

19 (3) "health care provider" means any — 

20 (A) medical care faciUty, and 

21 (B) any person or other entity that provides 

22 health services to individuals, 

23 (4) "Federal authority" means any agency or de- 

24 partment of the United States, or any officer, employ- 



88 



51 

1 ee, or agent thereof, but does not include the 

2 Congress, 

3 (5) "State" includes the District of Columbia and 

4 each United States territory or possession, 

5 (6) "State authority" means any agency or de- 

6 partment of any State, or of any local unit of govern- 

7 ment of any State, or any officer, employee, or agent 

8 thereof, but does not include a State legislature, 

9 (7) "Government authority" means any Federal 

10 or State authority, 

11 (8) "law enforcement inquiry" means a lawful in- 

12 vestigation or official proceeding inquiring into a viola- 

13 tion of, or failure to comply with, any criminal or civil 

14 statute or any regulation, rule, or order issued pursu- 

15 ant thereto, 

16 \ (9) "Secretary" means the Secretary of Health, 

\, 

17 Education, and Welfare, except that as to matters per- 

18 taining to a medical care facility of, or as to matters 

19 pertaining to services performed for, the Veterans' Ad- 

20 ministration or the Department of Defense, "Secre- 

21 tary" means the Administrator of the Veterans' Affairs 

22 and the Secretary of Defense, respectively, 

23 (10) the rights of, and obligations with respect to, 

24 an individual, shall be exercised by, and discharged 

25 through, respectively — 



89 

52 

1 (A) in the case of an individual under eight- 

2 een years of age, a parent or guardian of the indi- 

3 vidual, except (i) in those circumstances, as pre- 

4 scribed in regulations of the Secretary, in which it 

5 is in the interest of the individual to exercise his 

6 own rights and to have obligations with respect to 

7 him discharged through him, or (ii) as otherwise 

8 provided in subparagraph (B), and 

9 (B) in the case of an incompetent or de- 

10 ceased individual (or of an incompetent parent or 

11 guardian under subparagraph (A)), or of an indi- 

12 vidual (or a parent or guardian under subclause 

13 (A)) suffering from a health condition that pre- 

14 vents the individual (or parent or guardian) from 

15 acting effectively on the individual's behalf, an ap- 

16 propriate person (as defined by the Secretary), 

17 (11) a requirement to provide a notification or 

18 other matter to a person shall be satisfied if the notifi- 

19 cation or matter is sent to the last known address of 

20 the person, 

21 (12) "arbitrary" and "capricious" have the mean- 

22 ings of those terms under section 706(2)(A) of title 5, 

23 United States Code, and 

24 (13) "institutional review board" means — 



90 

53 

1 (A) such a board under section 474(a) of the 

2 Public Health Service Act, or 

3 (B) a similar board which meets such re- 

4 quirements as the Secretary may specify. 

5 EFFECTIVE DATE 

6 Sec. 311. Section 105 and title 11, with respect to dis- 

7 closure to State authorities, are effective two years after the 

8 enactment of this Act. This Act is otherwise effective one 

9 year after its enactment. 



91 



96th congress 
1st Session 



H. R. 5935 



To protect the privacy of medical information maintained by medical care facili- 
ties, to amend section 552a of title 5, United States Code, and for other 
purposes. 



IN THE HOUSE OF REPRESENTATIVES 

November 16, 1979 

Mr. Pbeyer (for himself, Mr. Kindness, Mr. Brooks, Mr. Hobton, Mr. 
Rangel, Mr. Carter, Mr. Kostmayer, Mr. Goldwater, Mr. Corman, 
Mr. Oberstar, Mr. Kildee, Mr. LaFalce, Mr. Mattox, Mr. Stockman, 
and Mrs. Fenwick) introduced the following bill; which was referred jointly 
to the Committees on Government Operations, Interstate and Foreign Com- 
merce, and Ways and Means 



A BILL 

To protect the privacy of medical information maintained by 
medical care facilities, to amend section 552a of title 5, 
United States Code, and for other purposes. 

1 Be it enacted by the Senate and House of Representa- 

2 tives of the United States of America in Congress assembled, 

3 SHORT TITLE 

4 Section 1. This Act may be cited as the "Federal 

5 Privacy of Medical Information Act". 



92 

2 

TABLE OF CONTENTS 

Sec. 1. Short title. 

Sec. 2. Findings and purposes. 

TITLE I— PRIVACY OF MEDICAL mFORMATION 

Paet a — Definitions, Effect on Other Laws, and Rights of Minors and 

Incompetents 

Sec. 101. Definitions. 

Sec. 102. Effect on other laws. 

Sec. 103. Rights of incompetents. 

Sec. 104. Rights of minors. 

Part B — Rights of Inspection, Amendment, and Notice, and Authorized 

Disclosure 

Sec. 111. Inspection of medical information. 

Sec. 112. Amendment of medical information. 

Sec. 113. Notice of information practices. 

Sec. 114. Disclosure of medical information. 

Sec. 115. Authorization for disclosure of medical information. 

Part C — Disclosure of Medical Information Without Specific 

Authorization 

Sec. 120. Right of medical care facilities to refuse disclosures. 

Sec. 121. Employee use. 

Sec. 122. Consultation. 

Sec. 123. Admission and health status information. 

Sec. 124. Health research. 

Sec. 125. Audit. 

Sec. 126. Health and safety. 

Sec. 127. Legally required reporting. 

Sec. 128. Secret service or foreign intelligence. 

Sec. 129. Next of kin. 

Sec. 130. Law enforcement functions. 

Sec. 131. Judicial and administrative proceedings. 

Sec. 132. Subpenas, summons, warrants, and search warrants. 

Sec. 133. Federal medical care facilities. 

Sec. 134. Restrictions on use of medical information by Federal grand juries. 

Part D — Access Procedures, Challenge Rights, and Reporting 

Sec. 141. Access procedures for law enforcement summonses, subpenas, warrants, 

and search warrants. 
Sec. 142. Challenge procedures for law enforcement summonses and subpenas. 
Sec. 143. Access and challenge procedures for other summonses and subpenas. 
Sec. 144. Construction of part; suspension of statute of limitations. 
Sec. 145. Reports. 



93 
3 

Part E — Enforcement 

Sec. 151. Criminal penalty for obtaining medical information through false pre- 
tenses or theft. 
Sec. 152. Civil suits. 
Sec. 153. Responsibilities of Secretary. 

TITLE n— AMENDMENT TO TITLE 5, UNITED STATES CODE 

Sec. 201. Amendment to title 5, United States Code. 

TITLE m— TRANSITION; EFFECTIVE DATES 

Sec. 301. Continued applicability of Act. 

Sec. 302. Effective dates and promulgation of regulations. 

1 FINDINGS AND PURPOSES 

2 Sec. 2. (a) Confess finds that — 

3 (1)(A) the right to privacy is a personal and fun- 

4 damental right protected by the Constitution of the 

5 United States, 

6 (B) the collection, maintenance, use, and dissemi- 

7 nation of medical information can threaten a patient's 

8 right to privacy, 

9 (C) medical information about a patient is dis- 

10 closed by medical care facilities without the knowledge 

11 or consent of the patient for purposes unrelated to the 

12 provision of medical services to the patient, 

13 (D) disclosure of medical information about a 

14 patient can affect the patient's ability to obtain 

15 employment, education, insurance, credit, and other 

16 necessities, 



94 



4 

1 (E) in order to prevent misuse of medical informa- 

2 tion, a patient must be able to exercise more direct 

3 control over medical information about the patient, and 

4 (F) a patient's right to privacy must be balanced 

5 against the legitimate needs of public and private orga- 

6 nizations for individually identifiable medical informa- 

7 tion in performing law enforcement, public health, 

8 medical research, health planning, fiscal, and other im- 

9 portant functions; and 

10 (2)(A) the Federal Government is playing an in- 

11 creasingly important role in the provision, payment, 

12 and regulation of medical Care, 

13 (B) due to the large number of patients who 

14 travel in interstate commerce seeking medical care, the 

15 large volume of medical information sent in interstate 

16 commerce, and the complex and interrelated nature of 

17 the modern medical care system, all medical care facil- 

18 ities affect interstate commerce, 

19 (C) violations of the confidentiality of medical in- 

20 formation as found by the Congress and by the Privacy 

21 Protection Study Commission are problems that re- 

22 quire national solutions, and 

23 (D) there is a need for Federal statutory protec- 

24 tion of the privacy of medical information collected and 

25 maintained by medical care facilities. 



95 



5 

1 (b) The purposes of this Act are — 

2 (1) to establish procedures allowing patients to in- 

3 spect and amend medical information about them; 

4 (2) to define the circumstances under which indi- 

5 vidually identifiable medical information may be dis- 

6 closed with, or without, the consent of the patient; and 

7 - (3) to make it a crime to request or obtain medi- 

8 cal information from medical care facilities under false 

9 pretenses. 

10 TITLE I— PRIVACY OF MEDICAL D^ORMATION 

11 Part A — Definitions, Effect on Other Law, and 

12 Rights of Minors and Incompetents 

13 definitions 

14 Sec. 101. For purposes of this Act: 

15 (1) The term "accounting" means, with respect to 

16 the disclosure of medical information maintained by a 

17 medical care facility, the recording, as part of such in- 

18 formation, of (A) the date, nature, and purpose of the 

19 disclosure, and (B) the name and business address of 

20 the person to whom the disclosure was made. 

21 (2) The term "aggravated property destruction" 

22 means damage to property (with a value in excess of 

23 $500) which causes a significant interruption or impair- 

24 ment of its function. 



96 



6 

1 (3) The term "audit" means an assessment, eval- 

2 nation, determination, or investigation relating to — 

3 (A) the effectiveness of, compHance with, or 

4 applicabihty of legal, fiscal, medical, or scientific 

5 standards or aspects of performance; 

6 (B) the Ucensing, accreditation, or certifica- 

7 tion of medical care facilities or medical care pro- 

8 fessionals; or 

9 (C) medical peer review; 

10 conducted by a representative of a public or private or- 

11 ganization or government authority, including the Joint 

12 Commission on Accreditation of Hospitals and a Pro- 

13 fessional Standards Review Organization. 

14 (4) The term "employee" means, with respect to 

15 a medical care facility or person, an individual who is 

16 employed by, responsible to, affiliated with, or perform- 

17 ing a function on behalf of, the facility or person, and 

18 includes, with respect to a medical care facility, a stu- 

19 dent or faculty member of a health professional school 

20 affiliated wdth the facility. 

21 (5) The term "government authority" means any 

22 entity (including a legislative entity) — 

23 (A) of the United States, or of any territory 

24 or possession thereof, or 



97 



7 

1 (B) of a State or political subdivision therein, 

2 or any officer, employee, or agent thereof. 

3 (6) The term "health research project" means a 

4 biomedical, epidemiologic, or health services research 

5 project or a health statistics project. 

6 (7)(A) The term "institutional review board" 

7 means — 

8 (i) an institutional review board established 

9 in accordance with regulations of the Secretary 

10 under section 474 of the Public Health Service 

11 Act, 

12 (ii) a similar board established under regula- 

13 tions of another Federal Government authority, or 

14 (iii) a similar board which meets such re- 

15 quirements as the Secretary may specify. 

16 (B) The term "appropriate institutional review 

17 board" means, with respect to a health research proj- 

18 ect intending to use medical information maintained by 

19 a facility or researcher, (i) the institutional review 

20 board for the organization sponsoring the project, (ii) 

21 the institutional review board for the facility or re- 

22 searcher, (iii) the institutional review board for another 
2S medical facility or institution which maintains medical 

24 information also intended to be used in the project, or 

25 (iv) an institutional review board established or desig- 



98 



8 

1 nated by the Secretary in accordance with section 

2 124(c). 

3 (8) The term "law enforcement inquiry" means a 

4 lawful investigation or official proceeding inquiring into 

5 a specific violation of, or failure to comply vdth, any 

6 criminal or civil statute or any regulation, rule, or 

7 order issued pursuant thereto. 

8 (9) The term "medical care facility" means — 

9 (A) a hospital or skilled nursing facility, 

10 (B) an intermediate care facility certified by 

11 a State agency for participation in a program 

12 under title XIX of the Social Security Act, 

13 (C) an intermediate care facility, outpatient 

14 clinic, or ambulatory care facility operated by a 

15 Federal Government authority, or 

16 (D) an outpatient clinic or ambulatory care 

17 facility receiving funds from a Federal Govern- 

18 ment authority under a grant or contract under 

19 the Public Health Service Act, title V of the So- 

20 cial Security Act, the Community Mental Health 

21 Centers Act, the Comprehensive Alcohol Abuse 

22 and Alcoholism Prevention, Treatment, and Reha- 

23 bilitation Act ot 1970, or the Drug Abuse Office 

24 and Treatment Act of 1972, if the clinic or facil- 



99 



9 

1 ity is made subject to the provisions of this Act 

2 by regulation of the Secretary. 

3 Such term does not include any such medical facility 

4 located outside the United States or which primarily 

5 serves inmates or residents of a prison, jail, or other 

6 penal or correctional facility. 

7 (10) The term "medical information" means any 

8 material that — 

9 (A)(i) contains information relating to the 
10 health, examination, care, or treatment of a pa- 
ll tient, or (ii) is to be added to such material under 

12 the provisions of this title, and 

13 (B) is in a form enabling the patient to be 

14 identified. 

15 (11) The term "patient" means a living 

16 individual. 

17 (12) The term "Secretary" means the Secretary 

18 of Health and Human Services. 

19 (13) The term "State" includes the District of 

20 Columbia and the Commonwealth of Puerto Rico. 

21 EFFECT ON OTHER LAWS 

22 Sec. 102. (a) No law of any State, or political subdivi- 

23 sion thereof, may authorize or compel the disclosure of medi- 

24 cal information which is prohibited under this title. 

25 (b) This title does not supersede — 



100 



10 

1 (1) any restriction on the disclosure or use of 

2 medical information under (A) section 333 of the Com- 

3 prehensive Alcohol Abuse and Alcoholism Prevention, 

4 Treatment and Rehabilitation Act of 1970, (B) section 

5 408 of the Drug Abuse Office and Treatment Act of 

6 1972, or (C) section 1166 of the Social Security Act; 

7 (2) any other such restriction of Federal, State, or 

8 local law on disclosure or use of medical information 

9 relating to alcohol or drug abuse, or examination, care, 

10 or treatment for such abuse; or 

11 (3) any restriction of Federal, State, or local law 

12 on inspection of or disclosure of medical information re- 

13 lating to psychiatric, psychological, or mental health 

14 examination, care, or treatment. 

15 (c)(1) A State may prohibit disclosure of medical infor- 

16 mation otherwise permitted to be disclosed under part C of 

17 this title. 

18 (2) Nothing in this title shall be construed to make any 

19 medical care facility of a Federal Government authority or 

20 any Federal agency subject to any State or local law not 

21 otherwise applicable. 

22 (d) The fact that this Act may permit medical informa- 

23 tion to be disclosed by a medical care facility shall not in any 

24 way abridge or destroy the confidential or privileged charac- 



101 



11 

1 ter of the information, except for the purpose for which the 

2 disclosure was made. 

3 RIGHTS OF INCOMPETENTS 

4 Sec. 103. (a) The rights of a patient under this title 

5 shall be exercised and discharged in the best interests of the 

6 patient through an authorized legal representative of the pa- 

7 tient, if the patient has been declared to be incompetent by a 

8 court of competent jurisdiction. 

9 (b) If a medical care facility determines that a patient, 

10 who has not been declared to be incompetent by a court of 

11 competent jursidiction, suffers from a medical condition that 

12 prevents the patient from acting knovdngly or effectively on 

13 the patient's own behalf, the rights of the patient to authorize 

14 disclosure under section 115 shall be exercised and dis- 

15 charged in the best interests of the patient by the medical 

16 care facility or, at the election of the facility, the patient's 

17 next of kin. 

18 RIGHTS OF MINORS 

19 Sec. 104. (a) Except as provided in section 103, in the 

20 case of a patient — 

21 (1) who is fifteen years of age or older, all rights 

22 of the patient shall be exercised by the patient; or 

28 (2) who, acting alone, has the legal capacity to 

24 apply for and obtain a type of medical examination, 

25 care, or treatment and who has sought such examina- 



102 



12 

1 tion, care, or treatment, the patient shall exercise all 

2 rights of a patient under this title with respect to medi- 

3 cal information relating to that examination, care, or 

4 treatment. 

5 (b) Except as provided in subsection (a)(2), with respect 

6 to a patient who is — 

7 (1) under twelve years of age, all the patient's 

8 rights under this title shall be exercised through the 

9 parent or legal guardian of the patient; or 

10 (2) twelve, thirteen, or fourteen years of age, the 

11 right of inspection (under section 111), the right of 

12 amendment (under section 112), and the right to au- 

13 thorize disclosure of medical information (under section 

14 115) of the patient may be exercised either by the pa- 

15 tient or by the parent or legal guardian of the patient. 

16 Paet B — Rights of Inspection, Coeeection, and 

17 Notice, and Authoeized Disclosuee 

18 inspection of medical infoemation 

19 ^ Sec. 111. (a)(1) Except as provided under subsection 

20 (b), a medical care facility shall permit a patient to inspect 

21 any medical information that the facility maintains about the 

22 patient, and shall permit the patient to have a copy of the 

23 information. The patient may designate in writing another 

24 individual to inspect, or to have a copy of, the information on 

25 behalf of the patient and to accompany the patient during the 



103 



13 

1 inspection. When a patient or other individual inspects or 

2 obtains a copy of medical information under this subsection, 

3 the facility may offer to explain or interpret the information. 

4 (2) Except as otherwise specifically provided by law, a 

5 medical care facility may — 

6 (A) require a written request for the inspection 

7 and copying of medical information under this section; 

8 (B) not charge a fee for permitting mspection of 

9 information under this section; and 

10 (C) charge a reasonable fee (no greater than the 

11 copying fee imposed on third-party payers) for provid- 

12 ing a copy of medical information under this section. 

13 (3) A medical care facility shall comply with or deny a 

14 request for inspection or copying of medical information 

15 under this section withui the period of thirty days (or such 

16 shorter period as may otherwise be provided by law) begin- 

17 ning on the date it receives the request. 

18 (b)(1) A medical care faciUty is not required by this sec- 

19 tion to permit inspection or copymg of information if — 

20 (A) in the exercise of reasonable medical judg- 

21 ment, the facility determines that inspection or copying 

22 of the information would cause sufficient harm to the 

23 patient so as to outweigh the desirabiHty of permitting 

24 access; 



104 



14 

1 (B)(i) the information consists of psychiatric, psy- 

2 chological, or mental health treatment notes, and (ii) 

3 the facility does not permit disclosure of the notes to 

4 any person not engaged in treatment of the patient ex- 

5 cept (I) with the patient's authorization or (II) under 

6 compulsion of law; 

7 (C) the information relates to psychiatric, psy- 

8 chological, or mental health examination, care, or 

9 treatment — 

10 (i) and relates to an individual other than the 

11 patient, 

12 (ii) the disclosure of which would constitute a 

13 danger to the physical safety of any individual, or 

14 (iii) and identifies or could reasonably lead to 

15 the identification of an individual who is a con- 

16 fidential source of information to a health care 

17 provider; 

18 (D) the information is (i) used by the facility solely 

19 for administrative purposes and not in the examination, 

20 care, or treatment of the patient, and (ii) is not dis- 

21 closed outside the facility; 

22 (E) the information duplicates information availa- 

23 ble for inspection under subsection (a); or 



105 



15 

1 (F) the information is compiled solely in reason- 

2 able anticipation of a civil action or proceeding or for 

3 use in such an action or proceeding. 

4 (2) If information is withheld under paragraph (1)(A), 

5 the facility shall permit the information to be inspected and 

6 copied by a person, selected by the patient, who is (A) a 

7 licensed or certified health professional, (B) an attorney, (C) a 

8 family member, or (D) other person permitted to be designat- 

9 ed under State law. If inspection or copying of medical infor- 

10 mation by the family member selected by the patient would 

11 cause sufficient harm to the patient or to a family member so 

12 as to outweigh the desirability of permitting access, the facili- 

13 ty is not required to permit access by the family member, but 

14 the facility shall permit the patient to select another person 

15 in accordance with this paragraph. 

16 (3) If a facility denies a request for inspection or copying 

17 under this section, the faciHty shall provide the patient (or 

18 patient's designated representative) with a written statement 

19 of the reasons for the denial. 

20 AMENDMENT OF MEDICAL INFORMATION 

21 Sec. 112. (a) In the case of a medical care facility that 

22 maintains medical information about a patient, if the patient 

23 requests in writing that the facility correct or supplement the 

24 medical information the facility shall, within the period of 

25 forty-five days (or such shorter period as may otherwise be 



106 



16 

1 provided under State law) beginning on the date it receives 

2 the request, either — 

3 (1)(A) make the amendment requested; (B) inform 

4 the patient of the amendment that has been made; and 

5 (C) inform any person who is identified by the patient, 

6 who is not an employee of the facility, and to whom 

7 the unamended portion of the information was previ- 

8 ously disclosed of the amendment that has been made; 

9 or 

10 (2) inform the patient of (A) the reasons for its re- 

11 fusal to make the amendment, (B) any procedures for 

12 further review of the refusal, and (C) the patient's right 

13 to file with the facility a concise statement setting 

14 forth the requested amendment and the patient's rea- 

15 sons for disagreeing with the refusal of the facility. 

16 After a patient has filed a statement of disagreement, the 

17 facility, in any subsequent disclosure of the disputed portion 

18 of the information, shall include a copy of the patient's state- 

19 ment and may include a concise statement of the facility's 

20 reasons for not making the requested amendment. 

21 (b) Subsection (a) shall not be construed to require a 

22 medical care facility — 

23 (1) to conduct a formal, informal, or other hearing 

24 or proceeding concerning a request for an amendment 

25 to medical information it maintains, or 



107 



17 

1 (2) to erase or otherwise delete any medical infor- 

2 mation it determines to be incorrect, 

3 and, for purposes of such subsection, a correction is deemed 

4 to have been made to medical information where incorrect 

5 information is clearly marked as incorrect and supplementary 

6 correct information is made part of the medical information 

7 about the patient. 

8 (c) For purposes of this section, the term "amendment" 

9 includes correction and supplementation. 

10 NOTICE OF INFORMATION PRACTICES 

11 Sec. 113. (a) A medical care facility shall prepare a 

12 written notice of information practices describing — 

13 (1) the disclosures of medical information that the 

14 facility may make without the written authorization of 

15 the patient; 

16 , (2) the rights and procedures under this title, in- 

17 eluding the right to inspect and copy medical informa- 

18 tion and the right to seek amendments to medical 

19 information, and the procedures for authorizing disclo- 

20 sures of medical information and for revoking such 

21 authorizations; and 

22 (3) the procedures established by the facility for 

23 the exercise of these rights. 

24 (b) A medical care facility shall, upon request, provide 

25 any person with a copy of the facility's notice of information 



56-421 0-80—8 



108 



18 

1 practices (described in subsection (a)) and shall post in con- 

2 spicuous places in the facility such notice or a statement of 

3 availability of such notice and otherwise make reasonable ef- 

4 forts to inform patients (and prospective patients) of the fa- 

5 cility of the existence and availability of such notice. 

6 DISCLOSURE OF MEDICAL INFORMATION 

7 Sec. 1 14. A medical care facility — 

8 (1) may not disclose medical information about a 

9 patient other than to the patient or the patient's desig- 

10 nated representative (under section 111) unless either 

11 (A) the patient has authorized the disclosure under sec- 

12 tion 115, or (B) the disclosure is permitted under part 

13 C without such an authorization; 

14 (2) may not disclose medical information to any 

15 person unless the person is properly identified; and 

16 (3) shall, in the case of disclosure of medical infor- 

17 mation made — 

18 (A) pursuant to an authorization described in 

19 section 115, limit the disclosure to the information 

20 authorized to be disclosed, or 

21 (B) without such an authorization, limit the 

22 disclosure to the information reasonably needed to 

23 accomplish the purpose for which the disclosure is 

24 made. 



109 

^^ 

1 For purposes of paragraph (3)(B), a facility may rely on a 

2 written certification, by the person seeking medical informa- 

3 tion, stating the purpose for which the information is being 

4 sought and that the information is reasonably necessary to 

5 accomplish that purpose. 

6 AUTHORIZATION FOR DISCLOSURE OF MEDICAL 

7 INFORMATION 

8 Sec. 115. (a) For purposes of this title, a patient has 

9 authorized disclosure to a person of medical information 

10 maintained by a medical care facility only if — 

11 (1) the authorization is (A) in writing, (B) dated, 

12 and (C) signed by the patient; 

13 (2) the facility is specifically named or generically 

14 described in the authorization as authorized to disclose 

15 such information; 

16 (3) the person to whom the information is to be 

17 disclosed is specifically named or generically described 

18 in the authorization as a person to whom such informa- 

19 tion may be disclosed; 

20 (4) the information to be disclosed is described in 

21 the authorization; and 

22 (5) the disclosure occurs before the date or event 

23 (if any), specified in the authorization, upon which the 

24 authorization expires. 



no 



20 

1 A State, or political subdivision therein, or a medical care 

2 facility may impose additional requirements for authorizations 

3 by patients of disclosures. 

4 (b) A patient in writing may revoke or amend an author- 

5 ization, in whole or in part, at any time, except when disclo- 

6 sure of medical information has been authorized to permit 

7 validation of expenditui-es for medical services or based on 

8 medical condition by a government authority or when action 

9 has been taken in reliance on the authorization. 

10 (c) A medical care facility that discloses medical infor- 

1 1 mation about a patient pursuant to this section shall maintain 

12 a copy of the authorization as part of the medical information 

13 about the patient. 

14 Part C — Disclosure of Medical Information 

15 Without Specific Authorization 

16 RIGHT of medical CARE FACILITIES TO REFUSE 

17 DISCLOSURES 

18 Sec. 120. Except as provided in section 111, nothing in 

19 this Act shall be construed to require a medical care facility 

20 to disclose medical information not otherwise required to be 

21 disclosed by law. 

22 EMPLOYEE USE 

23 Sec. 121. (a) A medical care facility may disclose medi- 

24 cal information it maintains about a patient, without the au- 

25 thorization described in section 115(a), if the disclosure is to 



HI 



21 

1 an employee (as defined in section 101(4)) of the facility who 

2 has a need for the medical information in the performance of 

3 his duties. 

4 (b) Medical information disclosed under this section shall 

5 not be further disclosed by an employee except in accordance 

6 with this title. 

7 CONSULTATION 

8 Sec. 122. (a) A medical care facility may disclose medi- 

9 cal information it maintains about a patient, without the au- 

10 thorization described in section 115(a), if the disclosure is to 

11 a medical care professional who will use the information in 

12 connection with examination, care, or treatment of a specific 

13 patient. 

14 (b) Medical information disclosed by a medical care fa- 

15 cility under this section shall not be further disclosed except 

16 where required by law or necessary to fulfill the purpose for 

17 which the information was obtained. 

18 ADMISSION AND HEALTH STATUS INFORMATION 

19 Sec. 123. A medical care facility may disclose medical 

20 information it maintains about a patient, without the authori- 

21 zation described in section 115(a), if the disclosure only re- 

22 veals the presence of the patient at the facility, his location in 

23 the facility, and his general condition, and — 

24 (1) the patient has not objected in writing to the 

25 disclosure, and 



112 



22 

1 (2) the information does not reveal specific infor- 

2 mation about the patient's condition or treatment. 

3 HEALTH RESEARCH 

4 Sec. 124. (a) A medical care facility may disclose medi- 

5 cal information it maintains about a patient, without the au- 

6 thorization described in section 115(a), if the disclosure is for 

7 use in a health research project (as defined in section 

8 101(6))— 

9 (1) which has been determined by an appropriate 

10 institutional review board (as defined in section 

11 101(7)(B)) to be of sufficient importance so as to 

12 outweigh the intrusion into the privacy of the patient 

13 that would result from the disclosure, or 

14 (2) which is being conducted by or under the di- 

15 rection of a government authority responsible for public 

16 health matters and the government authority certifies 

17 orally (with subsequent written confirmation) or in 

18 writing that the project is of sufficient importance that 

19 any delay pending a determination by an institutional 

20 review board could have a significant adverse effect on 

21 the public health. 

22 (b) Any person who obtains medical information pursu- 

23 ant to subsection (a) shall — 

24 (1) remove or destroy information that would en- 

25 able patients to be identified, unless the person deter- 



113 



23 

1 mines that there is an adequate health or research jus- 

2 tification for retention of such identifiers; 

3 (2) not disclose in any public report such medical 

4 information that would enable patients to be identified; 

5 and 

6 (3) not further use or disclose such medical infor- 

7 mation in a manner that would enable patients to be 

8 identified, except, if not otherwise prohibited by law — 

9 (A) for disclosure to an employee of the per- 
10 son who has a need for the information in per- 
il forming his duties under the project, 

12 (B) in emergency circumstances affecting the 

13 health or safety of any person or involving immi- 

14 nent danger of aggravated property destruction, 

15 (C) for use in another health research proj- 

16 ect, under the same conditions and subject to the 

17 same restrictions on use and disclosure applicable 

18 under this subsection to the original project, 

19 (D) for disclosure to a properly identified 

20 person for the purpose of an audit related to the 

21 project, if mformation that would enable patients 

22 to be identified is removed or destroyed at the 

23 earliest opportunity consistent with the purpose of 

24 the audit, or 

25 (E) when required by law. 



114 



24 

1 (c) If a person conducting a health research project is 

2 unable to obtain review by an institutional review board of 

3 the project for purposes of this section, the Secretary, upon 

4 application of the person, may establish an institutional re- 

5 view board or may designate any existing institutional review 

6 board to review the project. 

7 AUDIT 

8 Sec. 125. (a) A medical care facility may disclose medi- 

9 cal information it maintains about a patient, without the au- 

10 thorization described in section 115(a), for purposes of an 

11 audit (as defined in section 101(3)). 

12 (b) Any person who obtains medical information pursu- 

13 ant to subsection (a) — 

14 (1) shall remove or destroy, at the earliest oppor- 

15 tunity consistent with the purpose of the audit, infor- 

16 mation that would enable patients to be identified; 

17 (2) shall not disclose in any public report medical 

18 information that would enable patients to be identified; 

19 and 

20 (3) may (unless otherwise prohibited by law) fur- 

21 ther use or disclose medical information in a manner 

22 that would enable patients to be identified only — 

23^ (A) for disclosure to an employee of the enti- 

24 ty conducting the audit who has a need for the 

25 information in performing his duties under the 



115 



25 

1 audit or to the person for whom the audit is being 

2 conducted, 

3 (B) in emergency circumstances affecting the 

4 health or safety of any person or involving immi- 

5 nent danger of aggravated property destruction, 

6 (C) when required by law, 

7 CD) for use in a related audit subject to the 

8 restrictions on use and disclosure set forth in this 

9 subsection, and 

10 (E) for use in an administrative, civil, or 

11 criminal action or investigation, subject to the re- 

12 strictions on use and disclosure set forth in sub- 

13 section (c). 

14 (c) No medical information about a patient disclosed by 

15 a medical care facility under this section may be used in, or 

16 disclosed for, any administrative, civil, or criminal action or 

17 investigation directed against the patient except in an action 

18 or investigation arising out of and directly related to the pro- 

19 gram being audited. 

20 HEALTH AND SAFETY 

21 Sec. 126. (a) A medical care facility may disclose medi- 

22 cal information it maintains about a patient, vdthout the au- 

23 thorization described in section 115(a), if the disclosure is 

24 based on a good faith behef by the employees of the facility 

25 that the information is needed — 



116 



26 

1 (1) to assist in the identification of a dead person, 

2 or 

3 (2) to alleviate emergency circumstances — 

4 (A) affecting the health or safety of any per- 

5 son, or 

6 (B) involving imminent danger of aggravated 

7 property destruction (as defined in section 101(2)), 

8 and the facility maintains an accounting (as defined in 

9 section 101(1)) of the disclosure. . 

10 (b) Medical information disclosed by a medical care fa- 

1 1 cility under this section shall not be further disclosed except, 

12 if not otherwise prohibited by law, where necessary to fulfill 

13 the purpose for which the information was obtained. 

14 LEGALLY REQUIRED REPORTING 

15 Sec. 127. (a) A medical care facility may disclose medi- 

16 cal information it maintains about a patient, without the au- 

17 thorization described in section 115(a), if the disclosure is — 

18 (1) pursuant to a law requiring the reporting of — 

19 (A) specific medical information to public 
20- health authorities, 

21 (B) child abuse and neglect information, or 

22 (C) specific medical information to law en- 

23 forcement authorities; 



117 

27 

1 (2) of information described in paragraph (1) and 

2 the medical care facility is operated by a Federal 

3 agency; or 

4 (3) directed by a court in connection with a court- 

5 ordered examination of a patient, 

6 (b) Medical information disclosed by a medical care fa- 

7 cility under this section shall not be further disclosed except, 

8 if not otherwise prohibited by law, where necessary to fulfill 

9 the purpose for which the information was obtained, or for a 

10 purpose, and subject to the conditions, specified in sections 

11 124 and 125. 

12 SECEET SERVICE OR FOREIGN INTELLIGENCE 

13 Sec. 128. (a) A medical care facility may disclose medi- 

14 cal information it maintains about a patient, without the au- 

15 thorization described in section 115(a), if the disclosure is — 

16 (1) to— 

17 (A) the United States Secret Service for the 

18 purpose of conducting its protective functions 

19 under section 3056 of title 18, United States 

20 Code (relating to Secret Service powers), under 

21 section 202 of title 3, United States Code (relat- 

22 ing to the Executive Protective Service), or under 

23 Public Law 90-331 (relating to Secret Service 

24 protection of Presidential and Vice Presidential 

25 candidates), 



118 



28 

1 (B) a Federal Government authority author- 

2 ized by statute or executive order to conduct for- 

3 eign intelligence or counterintelligence activities 

4 for the purpose of conducting such activities; and 

5 (2) the government authority seeking the disclo- 

6 sure provides the facility with a written certification 

7 that— 

8 (A) is signed by a supervisory official of a 

9 rank designated by the head of the government 

10 authority, 

11 (B) specifies the information requested, and 

12 (C) states that the information is needed for 

13 a lav^l purpose under this section. 

14 If medical information is sought under paragraph (1)(B) about 

15 a patient who is a citizen of the United States or an alien 

16 lav^^ully admitted to the United States for permanent resi- 

17 dence, a government authority may not make the certifica- 

18 tion described in paragraph (2) unless the Attorney General 

19 has made a finding that there are reasonable grounds to be- 

20 lieve that the patient is an agent of a foreign power (as de- 

21 fined in section 101(b) of the Foreign Intelligence Surveil- 

22 lance Act of 1978 (50 U.S.C. 1801(b)). 

23 (b) No medical care facility, or employee of the facility, 

24 shall disclose to any person that a government authority has 

25 sought or obtained access to medical information under this 



119 



29 

1 section, and any written certification provided pursuant to 

2 this section shall not be made, or considered, a part of the 

3 medical information maintained by the facility about the 

4 patient. 

5 (c) Medical information disclosed by a medical care fa- 

6 cility under this section shall not be further disclosed except, 

7 if not otherwise prohibited by law, where necessary to fulfill 

8 the purpose for which the information was obtained. 

9 NEXT OF KIN 

10 Sec. 129. A medical care facility may disclose medical 

11 information it maintains about a patient, without the authori- 

12 zation described in section 115(a), if the disclosure is to the 

13 next of kin or legal representative of the patient or to individ- 

14 uals with whom the patient has a personal relationship, is 

15 consistent with accepted medical practice, and the patient 

16 has not previously objected. 

17 LAW ENFORCEMENT FUNCTIONS 

18 Sec. 130. (a) A medical care facility may disclose medi- 

19 cal information it maintains about a patient to a law enforce- 

20 ment agency, without the authorization described in section 

21 115(a), if— 

22 (1) the information is (A) for use in an investiga- 

23 tion or prosecution of fraud in a health or disabiUty 

24 program funded or operated by a government authori- 

25 ty, (B) to assist in the identification or location of a 



120 



30 

1 suspect, fugitive, or witness in a law enforcement 

2 inquiry, (C) in connection with criminal activity com- 

3 mitted at the medical care facility or against anyone 

4 associated with the faciUty, or (D) needed to determine 

5 whether a crime has been committed and the nature of 

6 any crime that has been committed by a person other 

7 than the patient; and 

8 (2) where disclosure of medical information is re- 

9 quested by the agency, the agency provides the facility 

10 with a written certification that — 

11 (A) is signed by a supervisory official of a 

12 rank designated by the head of the authority, 

13 (B) specifies the information requested, and 

14 (C) states that the information is needed for 

15 a lawful purpose under this section. 

16 (b) Medical information disclosed by a medical care fa- 

17 cility to an agency under this section shall — 

18 (1) not be disclosed for, or used in, any adminis- 

19 trative, civil, or criminal action or investigation against 

20 the patient, except in an action or investigation arising 

21 out of and directly related to the action or investigation 

22 for which the information was obtained, and 

23 (2) not be otherv^se used or disclosed by the 

24 agency, unless the use or disclosure is necessary to ful- 



121 



31 

1 fill the purpose for which the information was obtained 

,2 and is not otherwise prohibited by law. 

3 JUDICIAL AND ADMINISTRATIVE PROCEEDINGS 

4 Sec. 131. (a) A medical care facility may disclose medi- 

5 cal information it maintains about a patient, without the au- 

6 thorization described in section 115(a) if the disclosure is 

7 made pursuant to the Federal Rules of Civil or Criminal Pro- 

8 cedure or comparable rules of other courts or administrative 

9 agencies in connection with litigation or proceedings to which 

10 the patient is a party. 

11 (b) A person seeking medical information maintained by 

12 a facility about a patient under this section shall provide the 

13 facility with a written statement that the patient is a party to 

14 the litigation or proceedings for which the information is 

15 sought. 

16 SUBPENAS, SUMMONS, WARRANTS, AND SEARCH 

17 WARRANTS 

18 Sec. 132. (a) A medical care facility may disclose medi- 

19 cal information it maintains about a patient, without the au- 

20 thorization described in section 115(a), if — 

21 (1) the disclosure is pursuant to a subpena issued 

22 under the authority of a grand jury, 

23 (2) the disclosure is pursuant to an administrative 

24 summons, subpena, or warrant, or a judicial summons, 

25 subpena, or search warrant and the conditions for such 



122 

/ 

32 

1 disclosure under section 124 (relating to health re- 

2 search), section 125 (relating to audits), section 126 

3 (relating to health and safety), section 127 (relating to 

4 legally required reporting), or section 130(a)(1)(A) (re- 

5 lating to investigations or prosecutions of fraud) have 

6 been met; or 

7 (3)(A) the disclosure is pursuant to an administra- 

8 tive summons, subpena, or warrant or a judicial sum- 

9 mons, subpena, or search warrant, and (B) the facility 

10 is provided a written certification by the person seek- 

11 ing the information that the person has complied with 

12 the applicable access provisions of section 141 or 

13 143(a), 

14 and the facility maintains a copy of the summons, subpena, 

15 warrant, or search warrant as part of the medical information 

16 on the patient. Any person who obtains information under 

17 paragraph (2) shall comply with the same conditions and re- 

18 strictions on use and disclosure contained in the section for 

19 which conditions for the disclosure are met. 

20 (b) Medical information disclosed by a medical care fa- 

21 cility under paragraph (2) or (3) of subsection (a) shall — 

22 (1) not be disclosed for, or used in, any adminis- 

23 trative, civil, or criminal action or investigation against 

24 the patient, except in an action or investigation arising 



123 



33 

1 out of and directly related to the inquiry for which the 

2 information was obtained, and * 

3 (2) not be otherwise used or disclosed by the au- 

4 thority unless the use or disclosure is necessary to ful- 

5 fill the purpose for which the information was obtained 

6 and is not otherwise prohibited by law. 

7 (c) Nothing in this section shall be construed as 

8 authority for a medical care facility to refuse to comply with 

9 a valid administrative summons, subpena, or warrant, or a 

10 vaHd judicial summons, subpena, or search warrant. 

11 FEDERAL MEDICAL CARE FACILITIES 

12 Sec. 133. (a) A medical care facility of a Federal Gov- 

13 ernment authority, or other medical care facility providing 

14 services on behalf of a Federal Government authority, may 

15 disclose medical information it maintains about a patient, 

16 without the authorization described in section 115(a), if the 

17 disclosure is — 

18 (1) to a component of the Veterans' Administra- 

19 tion, and the information is needed to determine eligi- 

20 bility for benefits under title 38, United States Code; 

21 (2) to an official of the uniformed services (as de- 

22 fined in section 2101(3) of title 5, United States Code) 

23 and the information is needed to determine eligibihty 

24 for service-related benefits; 



56-421 0-80—9 



124 



34 

1 (3) by a medical care facility operated by the uni- 

2 formed sq'vices (as used in paragraph (2)) to an official 

3 of the uniformed service for the purpose of determining 

4 eligibility of a member of the uniformed service for 

5 service, promotion, assignments, or training; 

6 (4) to a congressional office or committee in re- 

7 sponse to an inquiry made by the patient, and the fa- 

8 cility maintains an accounting (as defined in section 

9 101(1)) of the disclosure; or 

10 (5) for the purpose of filing a claim against a third 

11 party, if — 

12 (A) the agency that operates facility is re- 

13 quired by law to pay for medical services provided 

14 to the patient, 

15 (B) there are reasonable grounds to believe 

16 that the third party is liable for the cost of the 

17 medical services provided to the patient, and 

18 (C) the patient is notified in writing of the 

19 intended disclosure at least ten days before the 

20 date such disclosure is made. 

21 (b) Medical information disclosed by a medical care fa- 

22 cility under this section shall not be further used or disclosed 

23 except — 

24 (1) where necessary to fulfill the purpose for 

25 which the information was obtained, or 



125 



35 

1 (2) for a use permitted under the section 552a of 

2 title 5, United States Code. 

3 RESTRICTIONS ON USE OF MEDICAL INFORMATION BY 

4 FEDERAL GRAND JURIES 

5 Sec. 134. Medical information about a patient disclosed 

6 by a medical care facility under section 132 (a)(1) pursuant to 

7 a subpena issued under the authority of a Federal grand 

8 jury— 

9 (1) shall be returnable on a date when the grand 

10 jury is in session and actually presented to the grand 

11 jury; 

12 (2) shall be used only for the purpose of consider- 

13 ing whether to issue an indictment or report by that 

14 grand jury, or for the purpose of prosecuting a crime 

15 for which that indictment or report is issued, or for a 

16 purpose authorized by rule 6(e) of the Federal Rules of 

17 Criminal Procedure; 

18 (3) shall be destroyed or returned to the medical 

19 care facility if not used for one of the purposes speci- 

20 fied in paragraph (2); and 

21 (4) shall not be maintained, or a description of the 

22 contents of such information shall not be maintained, 

23 by any government authority other than in the sealed 

24 records of the grand jury, unless such information has 

25 been used in the prosecution of a crime for which the 



126 

36 

1 grand jury issued an indictment or presentment or for 

2 a purpose authorized by rule 6(e) of the Federal Rules 

3 of Criminal Procedure. 

4 Part D — Access Peocedubes, Challenge Rights, 

5 AND Reporting 

6 ACCESS PROCEDURES FOR LAW ENFORCEMENT SUMMONS- 

7 ES, SUBPENAS, WARRANTS, AND SEARCH WARRANTS 

8 Sec. 141. (a) No government authority may obtain 

9 medical information about a patient from a medical care fa- 

10 cility for use in a law enforcement inquiry pursuant to an 

11 administrative summons, subpena, or warrant or a judicial 

12 summons or subpena under section 132(a)(3) unless — 

13 (1) there are reasonable grounds to believe that 

14 the information will be relevant to the law enforcement 

15 inquiry being conducted by the government authority; 

16 (2) except as provided in subsection (c), a copy of 

17 the summons or subpena has been served upon the pa- 

18 tient or mailed to his last known address on or before 

19 the date on which the summons or subpena was served 

20 on the medical care facility, together vdth a notice 

21 (pubhshed by the Secretary under section 153(a)(1)) of 

22 the patient's right to challenge the summons or sub- 

23 pena, in accordance with section 142; and 

24 (3)(A)(i) ten days have passed from the date of 

25 service or (ii) fourteen days have passed from the date 



127 



37 

1 of mailing, and within such time period the patient has 

2 not initiated a challenge in accordance with section 

3 142, or 

4 (B) disclosure is ordered by a court under such 

5 section. 

6 (b) A government authority which obtains a medical in- 

7 formation about a patient from a medical care facility pursu- 

8 ant to a search warrant shall, not later than forty-five days 

9 after the date the search warrant was served on the facihty, 

10 serve the patient with, or mail to the last known address of 

1 1 the patient, a copy of the search warrant. 

12 (c)(1) A government authority may apply to an appropri- 

13 ate court to delay (for an initial period of not longer than 

14 ninety days) serving a copy of a summons or subpena and a 

15 notice otherwise required under subsection (a)(2) with respect 

16 to a law enforcement inquiry. The government authority may 

17 apply to the court for extensions of the delay. 

18 (2) An application for a delay, or extension of a delay, 

19 under this subsection shall state, v^dth reasonable specificity, 

20 the reasons why the delay or extension is being sought. 

21 (3) If the court finds that— 

22 (A) the inquiry being conducted is within the law- 

23 ful jurisdiction of the government authority seeking the 

24 medical information; 



128 

38 

1 (B) there are reasonable grounds to believe that 

2 the information being sought will be relevant to the 

3 inquiry; 

4 (C) the government authority's need for the infor- 

5 mation outweighs the patient's privacy interest; and 

6 (D) there is reasonable grounds to believe that re- 

7 ceipt of a notice by the patient will result in — 

8 (i) endangering the life or physical safety of 

9 any person, 

10 (ii) flight from prosecution, 

11 (iii) destruction of or tampering with evi- 

12 dence, or 

13 (iv) intimidation of potential witnesses, 

14 the court shall enter an ex parte order delaying, or extending 

15 the delay of, the notice and an order prohibiting the medical 

16 care facility from revealing the request for, or the disclosure 

17 of, the information. 

18 (3) Upon the expiration of a period of delay of notice 

19 under this subsection, the government authority shall serve 

20 upon the patient, with the service of the summons or subpena 

21 and the notice, a copy of any applications filed and approved 

22 under this subsection. 



129 



39 

1 CHALLENGE PROCEDUKES FOR LAW ENFORCEMENT 

2 SUMMONSES AND SUBPENAS 

3 Sec. 142. (a) Within ten days of the date of service or 

4 fourteen days of the date of mailing of a summons or subpena 

5 of a government authority seeking medical information about 

6 a patient from a medical care facihty under section 132, the 

7 patient may file (without filing fee) — 

8 (1)(A) in the case of a State judicial subpena, in 

9 the court which issued the subpena, or 

10 (B) in the case of another subpena or summons is- 

11 sued under the authority of a State, in a court of com- 

12 petent jurisdiction; or 

13 (2) in the case of a summons or subpena issued 

14 under the authority of the United States, in the United 

15 States district court for the district where the patient 

16 resides or which issued the subpena, 

17 a motion to quash the subpena or summons. A copy of the 

18 motion shall be served by the patient upon the government 

19 authority by delivery of registered or certified mail. 

20 (b)(1) The government authority may file with the court 

21 such affidavits and other sworn documents as sustain the va- 

22 lidity of the summons or subpena. The patient may file with 

23 the court, within five days of the date of the authority's filing, 

24 affidavits and sworn documents in response to the authority's 



130 



40 

1 filing. The court, upon the request of the patient, the govem- 

2 ment authority, or both, may proceed in camera. 

3 (c) The court may conduct such proceedings as it deems 

4 appropriate to rule on the motion. All such proceedings shall 

5 be completed, and the motion ruled on, within ten calendar 

6 days of the date of the government authority's filing. 

7 (d)(1) A court may deny a patient's timely motion under 

8 subsection (a) if it finds that there are reasonable grounds to 

9 believe that — 

10 (A) the law enforcement inquiry is legitimate, and 

11 (B) the information sought is relevant to that 

12 inquiry, 

13 unless the court finds that the patient's privacy interest 

14 outweighs the government authority's need for the 

15 information. 

16 (2) In determining under this section whether a patient's 

17 privacy interest outweighs the government authority's need 

18 for the information, the court shall consider — 

19 (A) the particular purpose for which the informa- 

20 tion was collected by the facility; 

21 (B) the degree to which disclosure of the informa- 

22 tion will embarrass, injure, or invade the privacy of the 

23 patient; 

24 (C) the effect of the disclosure on the patient's fu- 

25 ture medical examination, care, or treatment; 



131 



41 

1 (D) the importance of the inquiry being conducted 

2 by the government authority, and the importance of 

3 the information to that inquiry; and 

4 (E) any other factor deemed relevant by the 

5 court. 

6 The patient shall have the burden of demonstrating that his 

7 privacy interest outweighs the need established by the gov- 

8 ernment authority for the information. 

9 (3) The court may assess against a Federal Government 

10 authority attorney fees and other litigation costs reasonably 

11 incurred in the case of any motion brought under subsection 

12 (a) against the authority and in which the patient has sub- 

13 stantially prevailed. 

14 (e) A court ruling denying a motion to quash under this 

15 section shall not be deemed a final order and no interlocutory 

16 appeal may be taken therefrom by the patient. An appeal of 

17 such a ruling may be taken by the patient within such period 

18 of time as provided by law as part of any appeal from a final 

19 order in any legal proceeding initiated against him arising out 

20 of or based upon the medical information disclosed. 

21 ACCESS AND CHALLENGE PROCEDURES FOR OTHER 

22 SUMMONSES AND SUBPENAS 

23 Sec. 143. (a) No person or government authority (other 

24 than under section 141) may obtain medical information 



132 



42 

1 about a patient from a medical care facility pursuant to a 

2 summons or subpena under section 132(a)(3) unless — 

3 (1) there are reasonable grounds to believe that 

4 the information will be relevant to a lawsuit or other 

5 judicial or administrative proceeding; 

6 (2) a copy of the summons or subpena has been 

7 served upon the patient or mailed to his last known ad- 

8 dress on or before the date on which the summons or 

9 subpena was served on the medical care facility, to- 

10 gether with a notice (published by the Secretary under 

11 section 153(a)(2)) of the patient's right to challenge the 

12 summons or subpena, in accordance with subsection 

13 (b); and 

14 (3)(A) ten days have passed from the date of serv- 

15 ice or fourteen days have passed from the date of the 

16 mailing and within such time period the patient has not 

17 initiated a challenge in accordance with subsection (b), 

18 or 

19 (B) disclosure is ordered by a court under such 

20 ^ subsection. 

21 (b) Within ten days of the date of service or fourteen 

22 days of the date of mailing of a summons or subpena seeking 

23 medical information about a patient from a medical care fa- 

24 cility under subsection (a), the patient may file (without filing 

25 fee) in the court or with the government authority that issued 



133 



43 

1 the summons or subpena, a motion to quash the summons or 

2 subpena, with a copy served on the person seeking the infor- 

3 mation. The patient may oppose, or seek to Hmit, the sum- 

4 mons or subpena on any grounds that would otherwise be 

5 available if the patient were in possession of the information. 

6 CONSTRUCTION OF PAET; SUSPENSION OF STATUTE OF 

7 LIMITATIONS 

8 Sec. 144. (a) Nothing in this part shall affect the rights 

9 of a medical care facihty to challenge requests for medical 

10 information. Nothing in section 141, 142, or 143 shall entitle 

11 a patient to assert the rights of a medical care facility. 

12 (b) If a patient files a motion under this Act which has 

13 the effect of delaying the access of a government authority to 

14 medical information about the patient, any applicable statute 

15 of limitations shall be deemed to be tolled for the period be- 

16 ginning on the date such motion was filed and ending on the 

17 date upon which the motion is decided. 

18 REPORTS 

19 Sec. 145. The Director of the Administrative Office of 

20 the United States courts shall include in his annual report to 

21 Congress (1) the number of delays of notice sought and the 

22 number granted under section 141(c), (2) the number of suc- 

23 cessful and unsuccessful challenges made under sections 142 

24 and 143(b), and (3) such other information as he deems 

25 appropriate. 



134 



44 

1 Part E — Enfoecement 

2 criminal penalty for obtaining medical 

3 information through false pretenses or theft 

4 Sec. 151. (a) Any person who, under false or fraudulent 

5 pretenses or with a false or fraudulent certification required 

6 under this Act, requests or obtains medical information about 

7 a patient from a medical care facility or an authorization from 

8 a patient to disclose such information shall be fined not more 

9 than $10,000 or imprisoned for not more than six months, or 

10 both. 

11 (b) Any person who, under false or fraudulent pretenses 

12 or with a false or fraudulent certification required under this 

13 Act, requests or obtains medical information about a patient 

14 from a medical care facility or an authorization from a patient 

15 to disclose such information and who intentionally sells or 

16 transfers such information for profit or monetary gain, shall 

17 be fined not more than $30,000, or imprisoned for not more 

18 than five years, or both. 

19 (c) Any person who unlaAvfully takes medical informa- 

20 tion from a medical care facility and who intentionally sells 

21 or transfers such information for profit or monetary gain shall 

22 be fined not more than $30,000, or imprisoned for not more 

23 than five years, or both. 



135 



45 

1 CIVIL SUITS 

2 Sec. 152. (a) Any patient whose rights under this title 

3 have been knowingly or negligently violated — 

4 (1) by an officer or employee of — 

5 (A) the United States, 

6 (B) any authority of a State which has 

7 waived its sovereign immunity under the Consti- 

8 tution to a claim for damages resulting from a 

9 violation of this title, or 

10 (C) any other government authority, 

11 while the officer or employee was acting within the 

12 scope of the office or employment, may maintain a civil 

13 action for actual damages and for equitable reUef 

14 against the United States, the State authority, or the 

15 other government authority, respectively; 

16 (2) by an officer or employee of — 

17 (A) a government authority of a State not 

18 described in paragraph (1)(B), or 

19 (B) another government authority, while the 

20 officer or employee was not acting within the 

21 scope of the office or employment, 

22 may maintain a civil action for actual damages and for 

23 equitable relief against the employee or officer; or 

24 (3) by a medical care facility, health researcher, 

25 auditor, or any other person, may maintain a civil ac- 



136 



46 

1 tion for actual damages and for equitable relief against 

2 the researcher, auditor, or other person. 

3 The district courts of the United States shall have jurisdiction 

4 in actions brought under this section. 

5 (b)(1) Any patient entitled to recover actual damages 

6 under this section because of a knowing violation of this title 

7 shall be entitled to recover the amount of the actual damages 

8 demonstrated, or $1,000, whichever is greater. 

9 (2) In any suits brought under this section in which the 

10 complainant has substantially prevailed because of a knowing 

11 violation of this title, the court may, in addition to any actual 

12 damages or equitable relief, award such punitive damages as 

13 may be warranted and may assess against the defendant rea- 

14 sonable attorney fees and other costs of Htigation reasonably 

15 incurred. 

16 (c) If a medical care facility has established a written 

17 internal procedure that allows a patient who has been denied 

18 inspection or amendment of medical information to appeal the 

19 denial, the patient may not file a civil action in connection 

20 with the denial until the earlier of (1) the date the appeal 

21 procedure has been exhausted or (2) five months after the 

22 date the original request for inspection or amendment was 

23 made. 

24 (d)(1) A medical care facility that makes a disclosure of 

25 medical information about a patient that is permitted by this 



137 

47 

1 title and not otherwise prohibited by law shall not be liable to 

2 the patient for such disclosure. 

3 (2) If the members of an institutional review board have 

4 in good faith determined that a health research project is of 

5 sufficient importance to outweigh the privacy interest of a 

6 patient, the members, the board, and the parent institution of 

7 the board shall not be liable to the patient as a result of that 

8 determination. 

9 (3) A medical care facility that relies in good faith on a 

10 certification by a government authority or other person and 

11 discloses medical information about a patient in accordance 

12 with this title shall not be liable to the patient for such 

13 disclosure. 

14 (4) A medical care facility that determines in accordance 

15 with section 103(2) and in good faith that a patient suffers 

16 from a medical condition that prevents the patient from act- 

17 ing knowingly or effectively on the patient's own behalf shall 

18 not be Hable to the patient as a result of that determination. 

19 RESPONSIBILITIES OF SECRETAEY 

20 Sec. 153. (a) The Secretary shall promulgate, by regu- 

21 lation, a notice — 

22 (1) for use under section 141(a)(2), detailing the 

23 rights of a patient who wishes to challenge, under sec- 

24 tion 142, the disclosure of medical information about 

25 the patient under such section, and 



138 

48 

1 (2) for use under subsection (a) of section 143, de- 

2 tailing the rights of a patient who wishes to challenge, 

3 under subsection (b) of such section, the disclosure of 

4 medical information about the patient under such 

5 section. 

6 (b) The Secretary shall pubHsh a nonbinding model no- 

7 tice of information practices describing the disclosures and 

8 rights of patients required to be included in the notices of 

9 information practices under paragraphs (1) and (2) of section 

10 113(a). 

11 TITLE n— AMENDMENT TO TITLE 5, UNITED 

12 STATES CODE 

13 AMENDMENT TO TITLE 5, UNITED STATES CODE 

14 Sec. 201. Section 552a of title 5, United States Code, 

15 is amended by adding at the end the following new 

16 subsection: 

17 "(r) Any medical information contained in a system of 

18 records maintained by a medical care facility subject to title I 

19 of the Federal Privacy of Medical Information Act shall not 

20 be subject to the provisions of subsections (b) through (d), 

21 (e)(3), (e)(4)(D), (e)(8), (e)(ll), (f)(3), and (g) through (k) of this 

22 section, if the medical information is subject to the provisions 

23 of such title.". 



139 



49 
1 TITLE m— TRANSITION AND EFFECTIVE DATES 

2 CONTINUED APPLICABILITY OF ACT 

3 Sec. 301. If a facility ceases to be a medical care 

4 facility, the provisions of this Act shall continue to apply to 

5 medical information maintained by the faciUty and obtained 

6 by the facility before it ceased to be a medical care facility. 

7 EFFECTIVE DATES 

8 Sec. 302. (a)(1) Except as otherwise provided in this 

9 subsection, this Act and the amendments made by this Act 

10 shall take effect on the first day of the first calendar quarter 

1 1 beginning more than one year after the date of the enactment 

12 of this Act. 

13 (2) This Act and the amendments made by this Act shall 

14 apply with respect to Federal medical care facilities on the 

15 first day of the first calendar quarter beginning more than 

16 one hundred and eighty days after the date of the enactment 

17 of this Act. 

18 (3) Section 151 shall take effect on the date of the en- 

19 actment of this Act. 

20 (4) Unless otherwise prohibited by law, an authorization 

21 of disclosure of medical information which — 

22 (A) was granted by a patient before the applicable 

23 effective date of this Act, 



56-421 O - 80 ~ 10 



140 



50 

1 (B) which was legally sufficient to authorize dis- 

2 closure of medical information on the date before such 

3 effective date, and 

4 (C) is not legally sufficient under section 115, 

5 shall nevertheless be valid for two years from such effective 

6 date unless the authorization is revoked by the patient as 

7 provided in section 115(b) or otherwise expires. 

8 (b) The Secretary shall first establish final regulations to 

9 carry out section 153(a) not later than the first day of the 

10 second month that begins before the effective date specified 

11 in subsection (a)(2). 

12 (c) If any provision of this Act, or the application of 

13 such provision to any person or circumstance, shall be held 

14 invalid, the remainder of this Act, or the apphcation of such 

15 provisions to persons or circumstances other than those as to 

16 which it is held invalid, shall not be affected thereby. 



141 

Mr. Weiss. If you would identify yourself for the record, Mr. 
Geller, as well as your associate with you, we can proceed. 

STATEMENT OF HENRY GELLER, ASSISTANT SECRETARY, COM- 
MUNICATIONS AND INFORMATION, U.S. DEPARTMENT OF 
COMMERCE; ACCOMPANIED BY ARTHUR BUSHKIN, DIREC- 
TOR, INFORMATION POLICY PROGRAM, NATIONAL TELECOM- 
MUNICATIONS AND INFORMATION ADMINISTRATION 

Mr. Geller. My name is Henry Geller. I am the Assistant Secre- 
tary of Commerce for Communications and Information. I am ac- 
companied here by Mr. Arthur Bushkin to my right. He is the 
Director of the information policy program at NTIA, the National 
Telecommunications and Information Administration. 

Mr. Weiss. The statement which you have prepared will be en- 
tered into the record, without objection, and you may proceed as 
you see most appropriate. 

[Mr. Geller's prepared statement follows:] 



142 



Testimony 

of 

Henry Geller, 

Assistant Secretary,, Communications and Information 

U.S. Department of Commerce 

before 

Subcommittee on Government Information & Individual Rights 

Committee on Government Operations 

U.S. House of Representatives 

April 4, 1979 

I am Henry Geller, Assistant Secretary of Commerce 

for Communications and Information. 

I would like to thank you for the opportunity to appear 

before you today to describe the Administration proposals 

for a national policy on personal privacy. These proposals 

were officially transmitted to the Congress on April 2, 

1979 in a Message from President Carter. In the message, 

the President outlined the two key principles of the national 

policy being proposed by the Administration: 

o First, sensitive, personal records must be provided 

privacy protections according to a set of "Fair 

Information Practices," modeled on those outlined 

by the Privacy Protection Study Commission. 

o Second, government access to, and use of, personal 

information must be limited and supervised so 

that power over information cannot be used to 

threaten our liberties. 

As you know, in 1977 the Privacy Protection Study 

Commission — created by the fine work of your committee 



143 



in the Privacy Act of 1974 — presented its Report and recommen- 
dations to this Committee, the Congress, the President 
and the public. Upon receiving the Report, President Carter 
directed that an Interagency Task Force evaluate the Commission's 
proposals and make further recommendations. The Task Force 
examined the specific recommendations of the Commission. 
We then drafted legislation translating the policy proposals 
into statutory language. As part of the drafting process, 
we consulted with private industry and other interested 
groups. 

C. L. Haslam, General Counsel of the Department of 
Commerce, testified before this Committee in June of 1978 
regarding the progress of the Task Force. In December, 
the Task Force made its recommendations to the President. 
We found that the detailed legislative recommendations 
of the Privacy Commission and the policy recommendations 
of the Interagency Task Force were still a long step away 
from workable statutory proposals. While the legislative 
proposals do not follow the Commission in all of their 
specific detail, it should be clear that the Administration 
accepts and endorses the approach to personal privacy which 
the Commission and so many others have proposed. As you 



144 



know, translating the recommendations of a study commission 
into statutory language is a difficult task which often 
requires recasting the language of a recommendation in 
order to achieve its goals. The Administration has tailored 
the legislation to minimize the costs of implementation 
in the private sector, while still providing strong privacy 
protections to individuals. 

Today, I will discuss with you the package of privacy 
legislation, administrative actions and voluntary guidelines 
which comprise the Administration's program. With the 
President's Message were three legislative proposals: 
the "Privacy of Medical Information Act," the "Privacy 
of Research Records Act," and the "First Amendment Privacy 
Protection Act of 1979". A fourth, multi-part bill, the 
"Fair Financial Information Practices Act" will be trans- 
mitted to the Congress later in the spring. This last 
bill establishes protection for the privacy of records 
held by consumer reporting agencies, credit grantors, check 
authorization and guarantee services, depository institu- 
tions, insurance companies, and Electronic Funds Transfer 
(EFT) service providers. 

I will briefly outline the proposed national policy 
objectives and the proposed individual rights in the leg- 
islative package. I will be glad to answer questions you 



145 



may have regarding this proposed legislation, however I 
will defer to the representative of the Department of Health, 
Education and Welfare to answer questions concerning the 
Medical Records bill. 

The proposed national policy is designed to protect 
personal privacy in today's electronic information society. 
Its objectives are to: 

o Halt the erosion of personal privacy which results 
from incremental, and generally well-intentioned, 
changes in the way private organizations and 
government collect, use and disseminate personal 
information. 
o Balance privacy protection with competing interests . 
The legislation recognizes the importance of 
safeguarding individual privacy while protecting 
legitimate information needs of business, govern- 
ment, and other institutions. 
o Avoid cresting new regulatory structures or imposing 
heavy costs, and emphasize voluntary efforts 
where government regulation is not needed. Where 
voluntary compliance could sufficiently protect 
individual rights, legislation has not been rec- 
ommended. The government will encourage and 
help develop guidelines for voluntary efforts. 



146 



Basic Privacy Rights 

The Administration's policy recognizes certain basic 
principles concerning the privacy rights of individuals 
in recorded information which an organization collects 
and maintains about them. An individual should have: 

o A right to know the information collection and 
disclosure practices of an organization, and 
the organization should be obliged to adhere 
to the practices it has established; 

o A right to see and obtain a copy of records about 
himself; 

o A right to challenge the accuracy of information 
about himself, with assurance that the record 
will be either corrected or amended to report 
his dispute; 

o A right to know the reasons for an adverse decision 
made about him, and to be able to see the infor- 
mation used in making that decision; and 

o A legally enforceable expectation of confidentiality 
for certain records, so that sensitive personal 
information about him will not be disclosed by 
an organization without authorization or without 
the individual, in most instances, being able 
to challenge that disclosure in court. 



147 



We should not lose sight of these important principles 
in working out the specific details of this legislation. 
They provide to each citizen a set of fundamental rights 
with regard to recorded information about him — rights which 
will be of ever increasing importance as society continues 
to grow and evolve. I will now turn to the specifics of 
each bill. 
T he "Privacy of Medical Information Act" 

The "Privacy of Medical Information Act" establishes 
important privacy protections for individuals with regard 
to medical information maintained by medical institutions. 
This bill is designed to protect an individual's right 
to privacy and accuracy in medical records, while avoiding 
interference in the sensitive doctor/patient relationship. 
Specifically, the bill: 

o Establishes privacy protections for information 
maintained by hospitals and other in-patient 
medical facilities, and any out-patient clinic 
or facility receiving Federal assistance; 

o Allows individuals to participate in decisions 

to dijsclose their medical records when the records 



will 



oe used to affect them, with some limited 



exceptions for emergency uses; 



Gives 



individuals the right to see their own 



148 



medical records. Where direct access to those 
records might harm the patient, access can be 
provided through an intermediary selected by 
the patient; 
o Allows the individual to ensure that records 

maintained as part of a medical-care relationship 
are accurate; and 
o Makes it a crime to obtain medical record infor- 
mation under false pretenses. 
It is, perhaps, most important that this bill clearly 
limits the disclosure of this sensitive personal information, 
It establishes an expectation of confidentiality for indi- 
viduals with regard to their medical records, and sets 
strict penalties for any improper disclosure. Yet, at 
the same time, the legislation allows the flexibility of 
disclosure which is vital for proper medical care, and 
for the valuable research and statistical, particularly 
epidemiological studies, which utilize information from 
medical records. 
"Privacy of Research Records Act" 

The "Privacy of Research Records Act" concerns the 
use of personal information for research studies — a use 
which requires a careful balancing of the individual's 
interest in privacy with society's need for knowledge. 



149 



Unlike other uses of personal records, research studies 
do not directly benefit the individual to whom the records 
pertain. Yet, at the same time, information contained 
in these records can be intensely personal and, if disclosed, 
may cause great harm to the individual. Medical, social 
service, and other researchers depend upon access to these 
records to conduct studies which benefit our entire society, 
and they often promise confidentiality to those who partici- 
pate or allow their records to be used. Today, however, 
virtually no legal basis for this promise of confidentiality 
exists. 

The "Privacy of Research Records Act" establishes 
clear protection for the individual whose records are used 
in research, but it will also allow for the continuation 
of valuable studies. The legislation establishes a policy 
of "functional separation" so that no personal information 
collected or maintained for a research purpose may be used 
or disclosed in individually identifiable form to allow 
the making of any decision which may adversely affect the 
individual to whom the record pertains. 

Specifically, the bill: 

o Provides for a legal standard of confidentiality 
which would allow researchers to release infor- 
mation for non-research purposes only to prevent 



150 



physical injury to an individual or in a medical 
emergency; 
o Ensures that research subjects are not recontacted 
by other researchers in a way that would embarrass 
or inconvenience them or otherwise intrude on 
their privacy. 
o Requires the researcher to tell research subjects 
of the possibility, if any, that information 
about them will be disclosed. 
o Provides criminal fines for unauthorized disclosure 
of research information, and gives individuals 
the right to sue for damages caused by any vio- 
lation of the Act. 
First Amendment Privacy Protection Act of 1979 

The United States Supreme Court's decision in Zurcher 
V. Stanford Dail y — which permitted police to use a search 
warrant to seize a reporter's notes — has raised serious 
concerns among many, including the T^dministration, over 
the effective functioning of a free press. The Administra- 
tion is committed to developing measures to protect First 
Amendment activities from unnecessarily intrusive searches, 
and still preserve legitimate law enforcement interests. 
Although requests for the issuance of subpoenas to the 
news media by Federal officers presently are limited strictly 



151 



by regulation, the Administration believes that the problems 
raised by Stanford Daily demand legislation to impose more 
stringent safeguards against Federal, state, and local 
governmental intrusion into a wide range of First Amendment 
activities. The President's announced legislation is de- 
signed to severely restrict third party searches for docu- 
mentary materials held by the press and others involved 
in the dissemination of information to the public. 

The premise underlying this legislation is that, absent 
extraordinary circumstances, such as the endangerment of 
life, the appropriate means of obtaining documentary evidence 
which is produced or possessed by persons involved in First 
Amendment activities (who are themselves not implicated 
in the commission of the crime under investigation) is 
through the use of a subpoena duces tecum rather than a 
warrant permitting a search for and seizure of materials 
in the homes and offices of reporters and others engaged 
in the preparation of information for the public. 
Fair Financial Information Practices Act. 

The proposed Fair Financial Information Practices 
Act which will be submitted to the Congress later this 
spring builds on existing consumer protection legislation 
like the Fair Credit Reporting Act, Equal Credit Opportunity 
Act, the Fair Credit Billing Act, and Truth in Lending. 



152 



It establishes privacy protection for records maintained 
by: 

1. Consumer reporting agencies; 

2. Credit grantors; 

3. Credit and check authorization and guarantee 
services; 

4. Depository institutions; 

5. Insurance companies, agents, and insurance-support 
organizations; and 

6. Electronic Fund Transfer (EFT) systems. 

I will outline the provisions of this multi-part bill 
as they apply to these different types of record keepers. 
Consumer Reporting Agencies 

The Fair Credit Reporting Act (FCRA) was passed in 
1970 to regulate the information collection and reporting 
practices of credit bureaus and consumer reporting agencies. 
The Act established in Federal law minimum privacy protec- 
tions for individuals who were the subject of consumer 
reports: consumers of insurance and credit services, and 
applicants for employment. 

The protections established in the FCRA for the records 
of consumer reporting agencies and credit bureaus must 
be strengthened. The Fair Financial Information Practices 
Act proposes amendments to the Fair Credit Reporting Act 



153 



which would: 

o , Give consumers the right to see and copy investi- 
gative consumer reports about them. Previously, 
consumers had only the right to learn the nature 
and substance of those records; 
o Improve the consumer's ability to correct disputed 

consumer reports; and 
o Prohibit "pretext" interviews (i.e., interviews 

conducted under false pretenses) to collect infor- 
mation for investigative consumer or credit re- 
ports. 
Credit Grantors 

Credit records frequently present a detailed history 
of an individual's life. The slips from credit transactions 
can show where an individual shops and travels, the kind 
of clothing he buys, the food he eats, where he works, 
and many other indices of his style of living. The infor- 
mation collected and reported by credit bureaus and other 
service organizations to the credit industry is already 
regulated by the Fair Credit Reporting Act, as well as 
some portions of statutes such as the Equal Credit Opportunity 
Act and Fair Debt Collection Practices Act which protect 
the consumer of credit services from certain abusive infor- 
mation practices. Yet these laws fail to provide consistent 



154 



and clear privacy protections regarding the information 
collected, maintained and reported by credit grantors them- 
selves. The Fair Financial Information Practices Act will 
give individuals privacy protections for most of the records 
used in evaluating whether he receives credit and in servicing 
existing credit accounts. Specifically, the legislation 
will: 

o Require credit grantors to inform individuals 

about their information collection and disclosure 
practices; 
o Provide that individuals be informed by a credit 
grantor of both the reasons for any adverse de- 
cision made about them and the items of information 
used to support the decision; and 
o Create a clear, legally-enforceable "expectation 

of confidentiality" regarding disclosure of records. 
An important feature is that the individual will 
have the legal right to challenge a request for 
disclosure of the records. 
Credit and Check Guarantee and Authorization Services 

In order to better serve consumers and to prevent 
fraud and abuse, our modern credit and banking systems 
have spawned the development of new types of service organi- 
zations: credit-card and check authorization and guarantee 



155 



services. These organizations provide information to mer- 
chants at the point of sale or payment so that they can 
determine whether to accept acredit card or check. These 
services also sometimes guarantee particular transactions. 
These organizations rely heavily on personal information 
reported to them from banks, creditors, employers and other 
sources. The information they report about individuals, 
if inaccurate or misleading, may cause great inconvenience 
or problems to a consumer .. It ;is thus important that privacy 
protections be established regarding the records used by 
these services so that individuals — and the organizations 
themselves — may better assure the accuracy of the information 
flowing within the system. 

The provisions of the bill covering these services 
will: 

o Ensure that independent authorization services 
maintain reasonable procedures to assure the 
accuracy of the information they collect and 
report; 
o ' Establish procedures to speed the correction 

of inaccurate information maintained by authori- 
zation services; and 
o Create a clear, legally enforceable expectation 
of confidentiality. 



156 



Depository Institutions 

The information accumulated by banks, savings and 
loan associations, and credit unions in the process of 
providing checking and depository services can become a 
virtual economic and social diary of an individual. In 
order to assure the confidentiality of these records, this 
bill regulates the disclosure of individual checking and 
savings account records. 

Specifically, the proposed legislation will: 

o Require depository institutions to notify indi- 
viduals of their record-keeping practices, and 
to follow that notice; and 

o Create a clear, legally enforceable expectation 
of confidentiality. 
Insurance Information Practices 

Insurance companies collect a great deal of highly 
personal information about individuals in the course of 
their business, both in the underwriting of insurance coverage 
and the settlement of claims. This part of the legislation 
will establish privacy protections for the records collected 
and maintained by insurance companies, their agents, and 
insurance-support organizations. 

Specifically, the legislation will: 

o Provide that individuals be notified of the in- 



157 



formation collection and disclosure practices 
of insurers; 
o Grant individuals the right to see, copy, correct, 

and amend insurance records about them; 
o Require individuals be informed by an insurer 

of the reasons for adverse decisions about them, 
and provided with the items of information used 
to support that decision; and 
o Establishe a clear legally enforceable expectation 
of confidentiality for individuals in their insur- 
ance records. 
This legislation will be enforceable by the individual 
through a right of action in Federal District Court, and 
by State Insurance Commissioners through their existing 
administrative and judicial procedures, as well as a right 
of action in Federal District Court. This legislation 
will not create nev; Federal regulatory authority for insur- 
ance, and it does not compromise the existing authority 
of the States to regulate insurance practices. 
Electronic Funds Transfer (EFT) Systems 

The Administration believes that protection must be 
afforded EFT transaction data as it flows through an EFT 
data communications network. This bill will erect safeguards 
against misuse of EFT systems for surveillance purposes. 



158 



while allowing adequate flexibility for commercial and 
technological innovation. 

Non-Legislative Actions 

This concludes the description of the legislative 
portion of the Administration's proposals. Let me now 
describe the other elements of the package. 
Employment and Personnel Records ^ 

Based upon all of the studies which have been done 
to date, including that of the Privacy Commission, it appears 
that Federal laws in the employment area would be difficult 
to enforce without creating an elaborate regulatory struc- 
ture. We are still studying this question. In the meantime, 
the Privacy Commission Report contained extensive recommen- 
dations for actions which private employers can implement 
on a voluntary basis to protect the privacy of their employees. 
The President endorses these recommendations as guidelines 
for private sector employers, and has instructed the Department 
of Labor and other appropriate agencies to monitor voluntary 
compliance by employers. These agencies will also consider 
the future need for an amended voluntary code, or perhaps 
Federal legislation. 

Federal legislation is, however, needed at this time 
in one limited aspect of employee privacy. The use of 
polygraph and other truth verification devices in private 



159 



sector employment should be severely restricted. Such 
legislation has already been introduced in this Congress. 
The Administration will support legislation in this area. 
Commercial Credit 

The concern in the area of commercial credit is that 
personal information may figure extensively in the credit 
granting decisions for' smaller businesses, such as partner- 
ships and sole proprietorships. Individuals who run small 
businesses should be able to see and copy, and challenge 
the accuracy of, commercial credit reports containing per- 
sonal information about them. They should also know if 
this personal information was the basis of an adverse com- 
mercial credit decision. Nonetheless, while these are 
important rights, it is not clear that privacy protections 
such as these are an appropriate matter for Federal legis- 
lation. Thus, the Administration has urged that commercial 
credit grantors and commercial reporting services voluntarily 
implement privacy measures relating to the personal infor- 
mation used in business credit decisions. The Federal 
agencies — and perhaps the Congress as well — will continue 
to study this question, and will monitor voluntary progress 
in this area. 
Public Assistance and Social Services 

Our public assistance and social service system depends 



160 



heavily upon the collection and use of personal information. 
Those seeking assistance generally must disclose sensitive 
personal information about themselves in applying for aid, 
and this information is subject to extensive verification. 
There is, in most cases, a clear and valid need for this 
information, whether for making a decision related to the 
individual, or for auditing and ensuring the integrity 
of the system. Yet, this does not mean that a recipient 
or applicant for public assistance should be without personal 
rights, such as privacy. Indeed, it is particularly impor- 
tant that privacy protections be incorporated into the 
information systems of public assistance and social service 
agencies, since the individual is often not in a position 
to assert those rights for himself. 

In his Message, the President called upon the States 
to adopt legislation to protect the rights to privacy of 
recipients of public assistance and other social services. 
The Department of Health, Education, and Welfare is also 
developing minimum protection standards for Federally funded 
programs, while maintaining adequate access to data for 
verification and other purposes. 
Wiretapping 

Title III of the Omnibus Crime Control and Safe Streets 
Act of 1968 governs the use of electronic surveillance 



161 



of wire and oral communications except in matters involving 
foreign intelligence or counterintelligence. The National 
Commission for the Review of Federal and State Laws Relating 
to Wiretapping and Electronic Surveillance studied the 
situation under Title III and issued findings and recommen- 
dations. The President has sent to Congress a letter which: 
o Endorses in general the recommended adjustments 
to strengthen Title Ill's protections for indi- 
vidual privacy; and 
o Does not support the recommendation to amend 
the law to allow Federal officials below the 
rank of Assistant Attorney General to apply to 
the courts for wiretaps. The President believes 
that such a change would diminish accountability 
and increase the danger of misuse. 
Administrative Actions for Federal Records 

In addition to these proposals slated for legislative 
and voluntary action, the President has announced a number 
of administrative actions to further individual privacy 
in Federal record-keeping. First, the Office of Management 
and Budget has issued new guidelines for the Federal agencies 
in their use of computerized "matching programs". The 
use of these programs by the Federal government raised 
significant public concern when two such projects were 



162 



announced last year. The new guidelines will ensure that 
these programs are conducted: 

o only after the public has been notified and given 

the opportunity to identify privacy problems; 
o with tight safeguards on access to the data and 

to the names of suspects identified by the matching 
process; and 
o only when there are no viable, alternative means 

of identifying violators. 
These guidelines are not designed to facilitate the 
widespread use of matching programs, but rather to control 
their use and protect the privacy of individuals when they 
are employed. Just as we cannot allow fraud and abuse 
in Federal government programs, so can we not permit our 
efforts in pursuing fraud and abuse in these programs to 
deprive those who derive the benefits and services of those 
programs of their basic human rights. 

The President has also directed that action to be 
taken to: 

o Extend the applicable requirements of the Privacy 
Act to data systems operated by certain recipients 
of discretionary Federal grants; 
o Strengthen administration of the "routine use" 

provision of the Privacy Act, which governs dis- 



163 



closures of personal information by Federal agencies; 
o Ensure that each Federal agency has an office 
responsible for privacy issues raised by the 
agency's activities; 
o Improve the selection and training of the system 

managers required by the Privacy Act; 
o Establish mechanisms to improve oversight of 

new Federal information systems at an early stage 
in the planning process; and 
o Strengthen oversight of the reports Federal agencies 
require individuals and organizations to fill 
out, helping to protect privacy by reducing the 
amount of information the government collects 
in the first place. 
Follov;-on Responsibilities 

The responsibilities for implementing the administrative 
actions for Federal records outlined above will rest with 
the Office of Management and Budget.. The Department of 
Commerce through my own organization, the National Telecommuni- 
cations and Information Administration, has been assigned 
the lead role in other privacy matters, including working 
with the Congress in the continuing development of privacy 
policy. 
Conclusion 



164 



Privacy is a vital human right in our society, essenti .1 
to the individuality and anatonomy of each American citizen. 
As records become more plentiful and more important, and 
as information technologies continue to develop, the need 
for the individual to participate in the control of the 
collection, use and disclosure of information about him 
will grow. 

I call on the Congress to act favorably on the new 
legislative privacy proposals which I have described today 
and to assist in encouraging the development of voluntary 
action in this important area. 

Thank you. 



165 

Mr. Geller. If I may, I will just go over some highlights of my 
statement and then be glad to answer your questions. 

The purpose of the President's program that you referred to is to 
halt the erosion in individual privacy that has occurred. It used to 
be that individuals had control over sensitive personal information. 
Today, as you make clear, that is fast eroding. An individual has to 
get credit, has to go into a hospital, has to get insurance. When he 
does so, he gives up a great deal of information about himself. 

That goes into computers and is flashed around the country. He 
has lost control over it. 

The purpose of the Pi-esident's program is to redress the balance, 
to give the individual rights in that process. 

We are building on a very solid base. For that base we are very 
grateful to this subcommittee. In 1974, the subcommittee enacted 
the Privacy Act that is applicable to the Federal Government. That 
act also called for a study by an independent Commission as to 
whether the principles embodied in it should be made applicable to 
the State and local governments and to the private sector. 

That Commission was established under the able leadership of 
David Linowes. It got out its report in 2 years. It was a very 
comprehensive report, it answered the question yes, the principles 
should be made applicable to the private sector. 

It, also, however, made clear that it could not be done simply 
across the board. Each industry had to be treated in light of its 
own problems. 

The President received that report in 1977. He pledged that it 
would not gather dust, that he would show strong leadership in 
enacting its recommendations. He therefore instituted an inter- 
agency committee under Stuart Eizenstat and the Department of 
Commerce. That committee has worked on these complex issues for 
the past year. 

What has evolved is the overall policy that is now before you. 

There are two basic principles in that policy. One of them is fair 
information practices. The other is limitations on Government 
access to personal data. 

In the first area, the principles have been to a great extent 
derived from the work of this subcommittee in 1974. An individual 
should know what information is being collected about him, how it 
is being collected, to whom it is going to be disclosed. He should 
have a right to see and copy his file. He should have a right to 
correct it. He should have a right to know about adverse decisions 
and the personal data upon which they are based. And there 
should be a legal right of expectation of confidentiality as to the 
sensitive material. They should not be improperly disclosed. 

In applying these principles in this policy initiative, there are 
several important considerations. 

The first is that our policy does not interfere with the flow of 
needed information to business or to the Government. 

The second is that we have not put any undue burden upon 
industry. We have taken into account the recommendations of the 
Privacy Commission in this respect. We have touched base with 
industry groups and with public groups to try to strike a proper 
balance here, and we believe we have. 



166 

We have tried to craft the policy so that it does not place an 
undue imposition or burden upon the particular record gatherer. 

Moreover, we have called upon voluntary action where that is 
appropriate. 

The third consideration is that we have imposed no new Federal 
regulatory structure. We relied upon existing structure. In general, 
we have followed the principle that the individual should be given 
his rights and then allowed to protect them himself in the courts. 

On the second broad principle I mentioned, limitation on Govern- 
ment, we believe that Government access to personal information 
must be limited and supervised so that the enormous power the 
Government may have over information cannot be used to threaten 
our liberties. 

As this subcommittee is aware, in the 1976 decision United 
States V. Miller, the Supreme Court held that records a bank has 
concerning you do not belong to you; they belong to the bank, and 
^ou have no constitutional right to prevent their dissemination. 
The Court said that any change here was up to Congress. 

With the strong backing of the administration. Congress did act 
last year and passed the Right to Financial Privacy Act. That 
changes the situation and strikes an entirely different balance. The 
individual has legal rights, in this situation. He must be notified 
when the Government seeks access to his records. And he has a 
right to challenge in court. That is, as we say, a fundamental 
difference. 

To implement these two principles, the administration has four 
pieces of legislation. 

The first is the Privacy of Medical Information Act. That is what 
is before you today. Mr. Libassi will be speaking upon it, so I will 
not go over that. 

The second is the Privacy of Research Records. Here we have 
sought to introduce the principles I refer to in the research field 
when Federal funds are involved. Individuals who are the subjects 
of research do not get any direct benefit out of that research. Yet it 
is extremely important to the Nation that it go forward. Therefore, 
researchers promise confidentiality today in order to induce people 
to give up what is often very sensitive personal data. 

There is no legal basis for their promise however. This bill would 
change that. There would be what we call a functioning separation 
of records used for research from any other use of those records. 
No information that was put into the research product could be 
used against the individual. 

There would be a complete separation with two very narrow 
exceptions. One would be if a crime of violence were involved. The 
other would be in a medical emergency involving the individual. 

In all instances other than these, privacy would be guaranteed. 
We believe this will facilitate research. It will give the people the 
assurance they need to engage in the project. 

A third bill is the First Amendment Privacy Protection Act. This 
bill deals with the Stanford Daily situation. You recall in Stanford 
Daily that the police obtained a search warrant. They went to the 
offices of the Stanford Daily in order to go through the files to look 
for photos. The Stanford Daily itself was not accused of any wrong- 
doing and was not involved in any wrongdoing. 



167 

The Stanford Daily argued that this search violated their consti- 
tutional rights as guaranteed by the first and fourth amendments. 
The Supreme Court disagreed. 

Again, the case went off on constitutional ground. The Court said 
that any remedial action would be a matter for Congress. 

The President believes that the Stanford Daily decision poses a 
severe threat to journalism and that it can have a chilling effect on 
the dissemination of information to the public. The bill that we 
have drafted would change this. 

The bill would proscribe the Government from using searches in 
order to obtain work product which was created by those engaged 
in the dissemination of information to the public. So, this would be 
a very broad and important right. 

There would be two narrow exemptions, and where work product 
is not involved, the Government, nevertheless, would have to pro- 
ceed with a subpena-first rule generally. 

The fourth bill in this privacy initiative is the Fair Financial 
Information Practices Act. That bill is being drafted. We are still 
going out contacting public groups and industry groups. 

This bill would deal with consumer reporting agencies, credit 
grantors, credit and check authorizations, guarantee services, de- 
pository institutions, insurance companies, and the electronic fund 
transfer systems. 

In the area of consumer credit, it would tighten the present law, 
the Fair Credit Reporting Act. It would improve procedures. 

In the area of insurance, it would, for the first time, lay down 
Federal protection for the records insurance companies keep about 
individuals. However, the implementation of this Federal privacy 
protection would not be provided by the Federal Government. The 
protection would stem, rather, from an individual's being able to 
sue in court or from a State commission's being able to implement 
the provisions of the bill. 

In the EFT area, we are dealing with a new phenomenon. More 
and more checks are being deposited electronically. Mortgage pay- 
ments are made electronically. People make purchases at a point of 
sale in a department store, and these can be electronically regis- 
tered. 

All this is to the good, but it means that in this electronic funds 
transfer, enormous amounts of information are built up. You could 
compile a virtual dossier on a person, knowing all his habits. 

EFT systems pose a second potential threat to privacy. That is 
that with them you can place surveillance on an individual. These 
systems are on-line, computer networks. If the coniputers are pro- 
gramed correctly, you can determine that an individual in a store 
in Peoria has bought a particular item at a particular moment. 

Clearly there is a need for privacy protection and for court 
supervision of this process. That is what the bill now being drafted 
will do. 

That is the program. The President has also called upon the 
States to take action, to adopt privacy policies in this field; that is, 
in their recordkeeping and particularly their criminal justice 
systems. 

He has called upon the States to adopt privacy protections in 
those areas of public assistance that they fund. He has called upon 



168 

HEW to develop minimum privacy standards for federally funded 
programs. 

As I have said, the President's policy calls for voluntary action, 
with respect to commercial credit and employment. In the area of 
employment, there are now a number of voluntary programs, spon- 
sored by such organizations as the NAM, the Business Roundtable, 
the Chamber of Commerce. 

The Secretary of Labor will be doing all he can to bring about 
adoption of those programs. 

The President has also said that he supports the principle of 
restricting the use of lie detectors, the polygraph, in employment 
situations, as proposed in the bill introduced by Senator Bayh. 

The administration will also be taking action within its own 
house. We have, for example, adopted new safeguards for privacy 
in our computer matching programs, a subject that this subcommit- 
tee has been so involved in and has been so helpful to us. 

We have also specified that each agency or department must 
have an officer in charge of privacy. We are improving the training 
of the officers who are in charge of these systems. 

We are extending privacy protection to certain Federal grantees. 

So, then, to repeat, we are taking a number of actions along 
these lines to enhance privacy within the administration's own 
bailiwick. 

This has been a very skeletal review, Mr. Chairman, of the 
program. We regard this privacy program as of the highest impor- 
tance. We believe that privacy, is a vital right in our society and 
that it is essential to the individuality of each American citizen. 

We look forward to working very closely with this subcommittee 
on this most important endeavor. 

That concludes my highlights. I would now be glad to try to 
answer your questions on the general administration program. 

Mr. Preyer [presiding]. Thank you very much, Mr. Geller. 

I know the committee commends you and the administration for 
your interest in this important field, a relatively new field. We look 
forward to working with you on it. 

I think you have given us a very good overview, as you said, of 
the basic principles, the need, and the priority which you attach to 
this whole effort. 

On the subject of priorities, the President's privacy package con- 
tains recommendations for a number of different bills. You have 
outlined them here. 

What are your priorities on these bills? Which ones do you think 
we ought to consider first? 

Mr. Geller. We would hope that this subcommittee would assign 
the medical records bill the high priority and, second, the research 
bill. We also will be proposing the fair financial information prac- 
tices bill, which will go to the Banking Committee. We would hope 
that it would proceed with that. 

There is, we believe, a clear and compelling need for action with 
regard to the Stanford Daily case. That bill will go to a different 
committee, the Judiciary. 

We are hopeful that there will be action concurrently in all these 
areas. 

Mr. Preyer. So, we will attack on a lot of fronts at once? 



169 

Mr. Geller. That is right. 

Mr. Preyer. The President's message to Congress indicated that 
the Privacy Act of 1974 was too new for revision at this time. The 
Privacy Commission, as you know, recommended an overhaul of 
that law 2 years ago. At what point do you think it would be 
appropriate to consider amending the Privacy Act? 

Mr. Geller. We believe, first, that we should take the steps we 
have outlined ourselves to improve the Privacy Act. That bill was 
passed in 1974, and was made applicable only in late 1975. 

We are now engaged in improving it through administrative 
means. For example, we are looking at the routine use problem. 
This year we will endeavor to take steps to correct problems that 
have arisen in that area. 

We believe that we ought to wait a couple of years to see wheth- 
er these administrative actions have been effective. So, I think 
what we are talking about would be more in the line of two years 
from now. 

Mr. Preyer. We would be interested in the results of your study 
of that act as to which aspects of it you think are working reason- 
ably well and which are not. I hope your administrative remedies 
might solve all the problems involved. 

The Privacy Commission also recommended changes in Federal 
laws protecting the confidentiality of educational and tax records. 
Maybe we should not complain that you have not included any 
more than you have. Is there any particular reason why these were 
not included? Or are you planning to go into that area? 

Mr. Geller. Well, that gets back to your first question, Mr. 
Chairman, and the matter of priorities. The Privacy Commission 
did make recommendations in each of these areas, and we did look 
at them. But in each of these areas they felt that the law which 
had recently been enacted — 1976 in the case of the Tax Reform 
Act — had very substantially improved the situation. 

It seemed to us a matter of priorities. After looking at the fields 
that we are considering today before you — medical, insurance, and 
others — it was decided that, as a matter of priority, what was 
needed in the education and tax areas was more fine-tuning. There- 
fore, we have decided to put those two areas on a back burner and, 
in terms of legislation, to go forward with what is more urgently 
needed. We shall await further experience with these other two 
areas that have been the subjects of recent attention and are 
working, we think, fairly well. 

Mr. Preyer. Would that be true also of the privacy of telephone 
toll records? 

Mr. Geller. In that area there is a difference. There is no 
legislation, unlike the case of tax reform. There is, however, a 
Supreme Court case pending; I believe it was just argued last week. 
We are awaiting a decision on that case because of its pertinence. 
If the Court, for example, holds that under the fourth amendment 
a search warrant is required whenever one wishes to obtain tele- 
phone toll records, then that would of course be a very important 
statement of rights and would affect whatever is done here. 

So, we are awaiting the Court's handling of the issue before we 
ourselves turn to it as a matter of policy. 

Mr. Preyer. Thank you. 



170 

Mr. Kindness? 

Mr. Kindness. Thank you, Mr. Chairman. 

Mr. Geller, there are two areas principally in which I would like 
to solicit your comments and advice. One is with respect to medical 
records. 

The hospital field has experienced quite a bit of daily living with 
Federal regulations, let us say, in recent years. Do you anticipate 
that the concept of this legislation would impose any new require- 
ments in terms of personnel and added cost? Assuming that the 
answer is yes, I am talking about substantial additional costs in the 
health care field attributable to legislation such as this — do you 
have any imput on that yet? 

Mr. Geller. Mr. Libassi, who will be testifying next, is more 
expert in this area than we are. HEW has looked into the matter 
much more closely than we have. 

We have tailored the bill so that we think it does not impose 
undue costs. Obviously, there will be some. We are now providing 
access to records, for example. We think people are entitled to have 
access to their records and have the ability to correct them. That 
may impose some cost, but we do not think it is inordinate. 

The VA hospitals are already under the Privacy Act of 1974. 
Based on their experience, and based on the way we have tailored 
the bill so as to avoid most of the costly logging and accounting 
requirements of the Privacy Act, we believe that while costs will be 
incurred, they will not be inordinate. Rather, they will be reason- 
able. 

I could go on, but I believe that Mr. Libassi is more expert on 
this and could discuss it better than I. 

Mr. Kindness. Specifically with respect to VA hospitals, do we 
have any measurement we might apply for some degree of guid- 
ance here? 

Mr. Geller. We believe the experience of the VA and other 
hospitals has indicated no inordinate burden. 

Mr. Kindness. I am not making my question clear, I guess. 

I am speaking of objective rather than of subjective evaluations 
like those that have added so much cost to health care already 
because we sit here and say, well, it's not going to be undue or 
inordinate, but it is. That is one of the problems in the health care 
field today, these inordinate costs are rising out of legislative ac- 
tions of this Congress and the regulatory actions pursuant thereto. 
I think we ought to be very careful to take any objective measure- 
ment that we have available to us as a guide at the present time. 

I am just wondering whether now or later perhaps you would 
have any figures of an objective sort to submit for the record. We 
would very much appreciate it. 

Mr. Geller. I think there should be. 

I did not mean to give you the impression this is all subjective. 
There is actual experience. That experience in numerical. It is 
concrete. That experience indicates that no new substantial person- 
nel will be needed and that there will be no new recordkeeping 
requirements of a nature that would impose what you are talking 
about. 



171 

Clearly, some people would have to be trained. There will be 
startup cost. That has been looked at. We do not think that that 
would be inordinate in view of the experience with the Privacy Act. 

The costs of the Privacy Act itself were greatly overestimated. I 
am talking generally. The costs turned out to be only one-eighth 
what they were estimated to be. 

But again I say that Mr. Libassi, when he testifies, will be able to 
supply more concrete information on this score. 

We are very sensitive to the problem of cost, though. We are 
aware of the importance of the issue you have raised. It is a very 
significant issue. We believe we have addressed it. 

Mr. Kindness. Thank you. 

In the other area, insurance information practices, the legisla- 
tion as proposed would provide that individuals be notified of the 
information collection and disclosure practices of insurers. Would 
you expand a little bit on what is actually proposed there as to who 
would be informed and by what means of notice? I am thinking, for 
example, of what we experienced with the necessity for amending 
the bill passed last year with respect to banks giving notification 
on too broad a basis, whether we might be considering looking very 
closely at the notice requirements in this situation. 

Mr. Geller. Certainly we would be glad to do that. You do not 
have the bill in front of you now. There is no bill. We are still 
working on it. 

On one of the reasons we are still working on it is to insure that 
there are no — you could used the word "glitches" or whatever. 
There are no gremlins of the nature that you refer to that occurred 
last year. 

We are going to the insurance industry as well as to other groups 
and saying, "Here is what we propose to do. Is there anything you 
see here that would cause an inordinate burden, such as having to 
notify all past depositors?" 

Essentially, what we are talking about here is, a situation in 
which when you go to purchase insurance, the insurance company 
would tell you, "Here is the information we need, and here is how 
we are going to go about collecting it." You, as an individual will 
then know, for example, if the company wants to run a check on 
your lifestyle, if it wants to talk to your neighbors and all that. It 
will then not come as a surprise that the company is checking. 

We are on the second draft of the bill. We will check it out 
carefully with the industry. 

Mr. Preyer. If the gentleman would yield a moment on that 
point. 

You are not then talking in any sense of compromising the 
authority of the States to regulate insurance practices. 

Mr. Geller. No. Not at all. We understand the McCarron-Fer- 
gusson Act and recognize that this is an area for the State. We 
have not imposed any Federal intervention so far as implementa- 
tion is concerned. 

We are imposing Federal standards, now. A number of insurance 
companies want that. They do not want the welter of State regula- 
tions. They would like to have a Federal base line. That is what we 
are providing. But it will not be implemented by any Federal 
authority. It will be implemented by the State commissions, if they 



172 

wish to do so. Or, in any event, the individual who will be given 
this Federal right will be able to implement it in court. 

Mr. Kindness. Thank you, Mr. Chairman. I think my time has 

expired. 

Mr. Preyer. Mr. Weiss? 

Mr. Weiss. Thank you, Mr. Chairman. 

I have, I guess, basically a philosophical question. I am interested 
in the framework with which the administration approached this 
subject. The opening statement of the chairman indicated how 
complex this whole area is. 

I wonder whether, in fact, the administration approaches the 
subject basically from the point of view of the right of privacy of 
individuals or from the point of view of the access to information 
on the part of the Government. It seems to me that the approach 
that one takes really will determine what kind of legislation one 
will come up with and what kind of enforcement or implementa- 
tion of that legislation one comes up with. 

Mr. Geller. I think that is an excellent question. I believe that 
we approach it by striking a proper balance. There is a clear need 
to redress the balance now. The individual right of privacy has 
eroded. The philosophy behind this policy initiative is to give the 
individual rights. So, we begin with that. 

We do not want, however, to give the individual rights of such a 
nature that we completely close down to the Government the flow 
of information that is appropriate for the Government to get. For 
example, the Government does need information in criminal pros- 
ecutions. The question is, how does it get it? 

Today, before this, it was getting it by simply walking in, flash- 
ing a badge, and saying, "I'm from the FBI; give me the informa- 
tion." They were getting it. 

We believe that that is all wrong. The Government has a right to 
try to obtain information that is relevant to criminal or other suits, 
but the individual ought to be notified. A court should be involved 
if the individual wishes to contest. And the court ought to be the 
agency that says, "Yes, this is relevant. This is proper. This person- 
al information should go to the Government." And it should not be 
decided simply by a bank, an insurance company, or a hospital 
without regard to the individual's rights. 

So, we have tried to strike a balance here. The balance is one 
that redresses the rights of the individual in an appropriate 
fashion. 

Mr. Weiss. In the example that you cited, for example, are you 
saying that the legislation which the administration supports and 
proposes would require that in all instances where the law enforce- 
ment agency is seeking medical records in regard to assistance in 
the prosecution of a case that, in order to be able to have access to 
that information, there has to be an application made to a judge, to 
a court with notification of that application being given to the 
individual whose records are being sought? Is that without doubt or 
without any question the premise of this legislation? 

Mr. Geller. The premise of the legislation is that the individual 
will be notified that information from his records is being sought 
and that the individual will have the right to go to court and 



173 

contest this. There are certain exceptions to this: fleeing the coun- 
try, for example. 

The difference is that, in the old days, the information could pass 
and the individual would not be aware of it. The premise now is 
that, with very narrow exceptions, the individual will be notified 
beforehand and will be able to contest the transfer of data. 

In any event, at some point the court — even in the narrow excep- 
tions — must be notified of what has occurred; and the individual 
must be notified. 

So, what we have done is brought accountability to the process, 
brought the court in, and brought sunshine in. You can no longer 
harass an individual for political reasons or for anything of that 
nature. There is now accountability in this process. 

These rights are spelled out in the Right to Financial Privacy 
Act and others; there are some narrow exceptions. But, for the 
most part, even for those exceptions there is still this accountabil- 
ity. The court must be notified. The individual must eventually be 
notified, although there can be delays of 90 days in certain cases. 

Mr. Weiss. Of course, the individual always has had the right to 
contest the prosecution's utilization of any information which was 
improperly or illegally gained by moving to quash that evidence or 
to prohibit its utilization against him in a course of trial. The 
question, I guess, really is whether, in the guise of giving him 
additional protection, the Government may in fact not be authoriz- 
ing the taking away of some of those protections. 

Mr. Geller. Before the 1978 act, the individual had no cogniza- 
ble interest, had no legal right. The same is true for the fields we 
are considering here, such as insurance. The records are not his. I 
refer to the situation with a bank, for example, before the 1978 act 
or today with insurance records. You would have no right to pre- 
vent the insurance company from giving your records to a Govern- 
ment agent when he walked in. 

We are changing that. An individual would now have a legal 
right. The insurance company could not turn those records over. 
There would be an expectation of confidentiality. The only way the 
company could turn them over would be if the Government used 
certain process. That process results in notification to the individu- 
al and his right to contest. 

As I say, there are some very narrow exceptions. One pertaining 
to foreign intelligence and there are some other ones; but they are 
very, very narrow and constrained. Generally speaking — and I am 
talking now about 99 percent or something of that order — what I 
have said is correct: The exceptions are very narrow. 

Mr. Weiss. You have been focusing on insurance and bank rec- 
ords. Does that apply also to medical records, health records? 

Mr. Geller. Yes. The bill which you have before you provides 
that general principle. 

Mr. Weiss. In the area of the exceptions, who makes the determi- 
nation as to whether the exception applies or not? 

Mr. Geller. A Government official would make that determina- 
tion. But in many instances he has to support it by reporting to the 
court that he has done it, that he has gone in and obtained the 
information, the reason why he has obtained the information — 
perhaps he feared destruction or perhaps the person in question 



174 

was going to flee the country, or something of that nature. The 
official has to show his reasons to the court. 

If it turns out that the matter has been handled improperly, 
there are penalties. If a court finds that it was done in bad faith, 
the office of personnel management must then consider disciplin- 
ary action other than penalties, actions such as liquidated dam- 
ages, actual damages, and punitive damages obtainable by the 
individual for violation of the act. 

Mr. Weiss. I appreciate your testimony. I think that, as far as 
the thrust or the aim is concerned, probably there is no question 
about the motivation. I think the reason why I have some ques- 
tions about how it ultimately gets implemented is because I think 
back, for example, to the electronic surveillance legislation which 
started out in principle to prohibit or to reduce the amount of 
electronic surveillance. When you read the legislation, especially 
when you see its implementation, you see that, in fact, there is 
hardly anything that is excluded. Even those areas which original- 
ly were included are now being eroded either by the courts or by 
further legislative action. 

So, I am always concerned that, when in fact we attempt to 
enhance people's rights or to spell out rights which they have 
under the Constitution, that we not end up, as we very often do, in 
taking away some of the rights which they still had before that 
legislation went into effect. 

Mr. Geller. I do not think we have done that. I am sure we have 
not taken away any rights. I think we have markedly improved the 
situation. 

I would stress to you again that we have brought sunshine into 
this situation. We have brought notice. We have brought account- 
ability. We have brought the courts in. That is very desirable, we 
believe. 

Mr. Weiss. Thank you very much. 

Thank you, Mr. Chairman. 

Mr. Preyer. Mr. Erlenborn. 

Mr. Erlenborn. Thank you, Mr. Chairman. 

Mr. Geller, are you here testifying on behalf of the administra- 
tion that at the present time there is widespread abuse of confiden- 
tiality in medical records? 

Mr. Geller. No, we are not. The matter does not, we think, turn 
on showing of abuse. 

There have been some abuses, I am told; but I do not know how 
widespread they are and I am not an expert in the problem. 

Mr. Erlenborn. You are not bringing us any horror stories as 
justification for our action? 

Mr. Geller. No. I am not coming before you with any horror 
stories. It may be that Mr. Libassi can point to some examples of 
abuse. I am sure they exist. 

I want to emphasize that we do not think the matter turns on a 
showing of abuses. It turns on doing what is right. 

Everything harmful that may be done in these privacy situations 
may be done in the most well-intentioned fashion. Hospital officials 
may turn over information about hospital records to Government 
agents or State agents or others in the most well-intentioned fash- 
ion. But we are saying that this is very sensitive information. The 



175 

individual should have rights about its dissemination. The Govern- 
ment should get such information only after notification and after 
certain process. 

There ought to be an expectation of confidentiality so that it is 
not the hospitals' information to give out as they wish. We do not 
say that they are doing it, but there ought to be rights built into 
the situation. 

Mr. Erlenborn. In effect you are saying that this is something it 
would be nice to do? 

Mr. Geller. Not nice to do but it 

Mr. Erlenborn. Let's say that is a given; we accept that: It is 
something that would be nice to do. The next question I have is, 
What argument do you have that it should be done at the Federal 

level? 1 • • 

Mr. Geller. Again, we are speaking of medical records; this is 

Mr. Libassi's area. There is some State legislation here, but not all 

States have laws. 

And, the information can be removed from one State to another, 

and that indicates a need for Federal law. 
Also, the States cannot impose any obligation with regard to 

Federal officers seeking information. Only the Federal Government 

can do that. 

There are a number of reasons why there ought to be this 
Federal base line. Without it, the personal information will be 
shifted around, and you will get this mish-mash of some States 
saying this and others saying that. 

This bill does not set aside State legislation. If there is State 
legislation that is, for example, more stringent, it will continue 
to 

Mr. Erlenborn. If it is less stringent? 

Mr. Geller. If it is less stringent, this bill provides a base line. 
This Federal one would hold, and it would 

Mr. Erlenborn. You mean the institution may have two laws 
that they have to follow? 

Mr. Geller. Whatever they 

Mr. Erlenborn. There is no preemption? 

Mr. Geller. They would have to follow the Federal law. If the 
State law is more stringent, they will continue to follow it as they 
do today; we do not preempt the field. 

Mr. Erlenborn. Well, you know, what is more stringent, what is 
less stringent is sometimes a matter of judgment. It is not just easy 
to say 50 percent, 60 percent, 70 percent. There may be different 
ways of doing something to achieve the same end. 

You are telling us that this proposal does not preempt State 
law 

Mr. Geller. It does not. 

Mr. Erlenborn. So that the institutions may have two laws to 
follow: The State and the Federal. 

Mr. Geller. The VA hospitals already must adhere to a great 
deal of these privacy requirements under the Privacy Act— but not 
to all of them. But the hospitals may very well also have to meet a 
higher State standard if such a standard exists. That means, as I 
say, that these institutions are following two laws today. If they 



176 

are, then the Federal standards may not affect them at all because 
they are less stringent. 

Mr. Erlenborn. I'd like to comment on your basis for legislative 
action. Because something would be nice to be done and not all the 
States have done it really does not seem to me to be a good 
argument for having the Federal Government do it unless we have 
some unique jurisdiction or reason to at the Federal level. 

I have heard the argument— often coming from the business 
community; and you suggested that earlier in answer to one of the 
questions— it would be nice to have one standard nationwide. That 
argument, of course, leads me to believe that what we possibly 
ought to do is to abolish the State legislatures. We could do all the 
legislating here. We would have national standards everywhere. It 
would be so much handier. Nobody would have to wonder from one 
State to the other what laws you had to follow because we would 
not have all of those bothersome State laws standing in the way. 

Do you think that there is really a justification in this area to 
accept that argument that it would be nice to have national stand- 
ards? 

Mr. Geller. I think that there is a very strong justification. We 
are dealing here with the fundamental rights of individuals to 
privacy. The erosion of this privacy is occurring nationwide. The 
computers, the telecommunications links are all nationwide. We 
think therefore, that the Federal Government and Congress should 
move to correct this. 

We are talking about an issue on which all people, I would 
think— liberal, conservative, whatever persuasion— could all agree. 
What has made this country remarkable is how it treats the indi- 
vidual. 

Mr. Erlenborn. If that is really true, I would think that you 
would argue for the preemption then. 

Mr. Geller. Well, if the State wishes to go further and afford 
even more stringent rights— we had not looked at all these laws; 
we are not 

Mr. Erlenborn. Then we lose that nice uniformity, you see. 

Mr. Geller. But we are providing a base. And that is what is 
important because we are talking about such a fundamental right. 
All individuals— not just those in 21 or 22 States, but all of them— 
should have this fundamental right of privacy. 

As to whether some of these laws are inordinately burdensome, 
we come back to what you yourself mentioned. That is we do not 
want to sit in judgment on each one of the State legislatures. If, in 
their wisdom, they have imposed some greater burden, we have not 
considered that. We do not know. We are not experts. And we have 
not preempted the field. 

Mr. Erlenborn. It is, I guess, a sign of the times of the last 20 or 
30 years or whatever that we have decided something would be 
nice to be done and it ought to be done at the Federal level. But 
there are a lot of things that seem to be quite necessary like 
licensing drivers of automobiles, registration and licensing of auto- 
mobiles, physicians, lawyers, any number of things that were good 
things and should have been done and were done by the States. 

But in recent years it seems as though we do not have any faith 
at all that the States have the competency to do this. Or we are so 



177 

impatient that we cannot wait for them to do the things that are 
nice to be done. So, somebody comes along with a suggestion, "Let's 
do it at the Federal level; we will just impose that on the whole 
country all at once." 

That is just an observation. You do not have to answer it. 

Let me ask you this. I was interested as to the cost estimates. 
Did you crank into your cost estimates— or does Mr. Libassi crank 
into the cost estimates— the cost of the attorneys' fees for the 
institutions going into court to respond to the applications made by 
law enforcement officers? 

Mr. Geller. Again, I would have to leave that to Mr. Libassi. 
That is a difficult thing to calculate because you have to try to 
figure out how many suits will occur, and how many you think will 
be successful. 

I think the only thing we can look to is the experience with the 

VA. 

Mr. Erlenborn. Well, I am kind of drawing on my experience, 
too, as a member of this committee back when the original Free- 
dom of Information Act was passed. I have had something to do 
with the shaping of both the Freedom of Information Act and the 
Privacy Act. I have also been engaged in some of the oversight that 
this committee very wisely has conducted. 

We found considerable expense on the part of the Federal Gov- 
ernment in conforming to the legislation that we drafted out of this 
very subcommittee. 

Let me put this to you. Let us say that we are not at all 
confident as to estimates of cost. Would you feel comfortable with a 
law that would allow a passthrough to the consumer of the cost 
that we impose on the institutions? 

You know, we have the Federal Government on the one hand 
saying, "Let's have hospital cost containment." On the other hand 
it is legislating new things for the hospitals to do. 

Would it not be fair to have a passthrough or an exemption from 
hospital cost containment of those new additional expenses, what- 
ever they might be— minimal, not excessive, or maybe more than 
we anticipate— to allow the institution to pass that through with- 
out being caught between the devil and the deep blue sea with 
hospital cost containment saying you cannot raise your prices but 
the Federal Government saying you must do this or that? 

Mr. Geller. I just want to make one thing clear. There are many 
ways where a hospital would not get involved in the court process 
that you are referring to. For example, when the Government 
seeks individual records from a hospital, it is up to the Govern- 
ment to carry the burden. The hospital is left out entirely. The 
hospital gets a certificate from the Government that it has met the 
law's requirements and that is its protection. 

Mr. Erlenborn. The hospital may want to contest the Govern- 
ment's claim. 

Mr. Geller. It may, but I would 

Mr. Erlenborn. I would hope in some instances they would. 

Mr. Geller. But I would think they would leave it very largely 
to the individual 

Mr. Erlenborn. How about the passthrough? 



178 

Mr. Geller. We believe that the costs involved here are not at 
all substantial. 

Mr. Erlenborn. Then you should not be afraid of a passthrough 
provision; should you? 

Mr. Geller. I do not understand how the passthrough provision 
would work. 

Mr. Erlenborn. It would exempt these extra costs from the 
hospital cost containment legislation that is being considered. 

Mr. Geller. It is not within my bailiwick. All I can answer to you 
is that it is beyond my power to make a comment on that. 

Mr. Erlenborn. I have one last question. I notice that you 
describe those institutions that would be affected by this Privacy of 
Medical Information Act as hospitals, other inpatient medical facil- 
ities, any outpatient clinic or facility receiving Federal assistance. 

At first blush, that seems pretty reasonable until I remember 
what your organization, HEW, did with title IX 

Mr. Geller. Not me. 

Mr. Erlenborn. Excuse me. You are not HEW. 

It is what another element of our Government did with title IX 
of the education amendments, 1972, where Brigham Young Univer- 
sity and a few other institutions that carefully avoided ever taking 
any Federal funds were found by HEW to be recipients of Federal 
funds because some of the students received Federal guarantees 
and loans or maybe basic educational opportunity grants, supple- 
mental educational opportunity grants. So, of course, the long arm 
of the Federal Government got into Brigham Young and into a few 
of these other institutions. 

Would a physician's office, because he has a medicare or medic- 
aid patient, be a facility receiving Federal assistance? 

Mr. Geller. No. The only thing that is done with regard to the 
physician is to impose a limitation on the Government when it 
seeks records that are in the possession of the physician. 

Mr. Erlenborn. What limitation do you have on this facility 
receiving Federal assistance? Do you say "directly"? 

Mr. Geller. Yes, if it 

Mr. Erlenborn. In your proposed legislation does it say "direct- 
ly"? Or does it allow the interpretation of an indirect receipt? 

Mr. Geller. I think it has to directly receive Federal assistance. 

Mr. Erlenborn. Could you cite that for me? 

Mr. Geller. Yes, we will find it. 

Mr. Erlenborn. I have found that people, especially in HEW, 
are able to interpret these things quite broadly to get Federal 
jurisdiction almost anywhere they want. 

Mr. Kindness. Will the gentleman yield? 

Mr. Erlenborn. Yes. 

Mr. Kindness. In the summary of the bill under enforcement — I 
guess it is the fifth page of the summary — there is reference to 
section 106: medical care facilities not in substantial compliance 
with the requirements of the draft bill— would be subject to remov- 
al from the medicare and medicaid programs and loss of funds 
under the Public Health Service Act and related laws. That gives 
us a little hint of what the gentleman is getting at, I believe. 



179 

Mr. Geller. The question was asked about physicians. Physicians 
do not come under the bill other than to receive protection as to 
their files. 

With regard to hospitals or with regard to other institutions that 
receive Federal assistance, they must comply. If they fail to 
comply, there can be a cutoff of Federal funds. Besides a cutoff, 
which may be very drastic, there are other remedies that affect the 
officials that are involved. But I repeat to you that there are ways 
that hospitals can avoid these liabilities. They can do this through 
the use of an institutional review board for access by researchers 
and by obtaining the certificate of compliance with Government 
access provisions. The hospital would be out of the picture entirely. 

In answer to your question, I believe that the definition is in 
section 310. That section defines a medical care facility as any 
facility— including any Federal facility— but excluding any State or 
local facility that does not receive any Federal funds after the 
effective date of this act. 

Mr. Erlenborn. It does not say directly or indirectly; does it? 

Mr. Geller. No, it just says excluding a facility that does not 
receive any Federal funds. 

Mr. Erlenborn. Well, I am confident that there is not any 
medical facility in this country that you could not describe as 
receiving Federal funds directly or indirectly. 

Mr. Geller. It is repeated again: "If a facility is receiving funds 
from appropriations authorized by the Public Health Service Act,'' 
and it names other acts and I am now in section 310, "definitions" 
which talks about receiving funds from particular acts. 

Mr. Erlenborn. Which would include medicare and medicaid— 
which probably covers every doctor in the country. 

Mr. Geller. Not doctors. Doctors are not covered at all. 

Mr. Erlenborn. Are they excluded specifically? 

Mr. Geller. Yes. This bill does not lay any requirement or any 
obligation upon the physician. It deals with hospital 

Mr. Erlenborn. Does it define out 

Mr. Geller. Yes. The only thing that 

Mr. Erlenborn. How about a clinic operated by several doctors? 

Mr. Geller. It would apply to an inpatient clinic if it were 
receiving Federal assistance, if it were receiving Federal funds. 

But a particular physician would not be an outpatient clinic. But, 
if several of them, I gather, formed an outpatient clinic or an 
inpatient medical facility, the law would apply to them. 

Mr. Erlenborn. I see on page 46 under definitions, it says "a 
health care provider is any person or any other entity that pro- 
vides health services to individuals." 

I do not want to press the point. Let us just say that I have 
raised it. Let us think about it. 

Mr. Preyer. Mr. Libassi will be able to answer that. 

Mr. Geller. Mr. Libassi is more expert, but I believe the clear 
intent of the bill is that it should not lay obligations upon individu- 
al physicians. 

Mr. Erlenborn. I am never satisfied with what we here think 
the intent may be. I have good cause to believe that our bureau- 
crats are very inventive in thinking up new ways to interpret the 
language we include unless we are quite specific. 



180 

Thank you, Mr. Chairman. 

Mr. Preyer. Thank you. We will have some other witnesses that 
will be addressing these points. 

I hope they will, when Mr. Libassi testifies, perhaps address 
themselves to this question. Mr. Erlenborn mentioned that there 
were no horror stories as justification for the medical records legis- 
lation. But I think there is a distinction between access to medical 
records and the abuse of that, which is widespread, and unauthor- 
ized use of the information which is obtained. Examples of that are 
harder to come by. 

As I understand it, what you were telling us is that the unau- 
thorized access to medical records is the real justification for legis- 
lation, that is where the erosion of privacy is occurring these days. 

Mr. Geller. Yes, sir. 

Let me say that there are abuses. The bill, for example, provides 
that you cannot get this information through false pretenses. That 
has occurred. Insurance investigators pretend to be a doctor or 
something and gain access to records. 

There was a case in Colorado where such false pretenses played a 
role. The Supreme Court of Colorado held that there was no legally 
recognizable right of an individual to keep his hospital records 
private. So, there have been abuses. The bill does deal with those 
abuses. 

But your statement is correct, Mr. Chairman. What we are 
trying to do is redress the balance generally. Even if there were 
not those abuses, this type of sensitive personal information is 
something the individual should have rights about, to have protect- 
ed. A hospital should not be able to give out its records as it 
wishes. There ought to be an expectation of confidentiality, a legal 
right to preserve that confidentiality. 

Mr. Preyer. He should have that right even though a hospital 
never sold that information improperly to a credit agency or some- 
thing like that? 

Mr. Geller. I am sure that most hospitals are acting very re- 
sponsibly. Nevertheless, there should be that right. 

Mr. Preyer. Thank you. 

Mr. Kostmayer. 

Mr. Kostmayer. Thank you, Mr. Chairman. 

I am rather puzzled by the views expressed by my distinguished 
colleague from Illinois. These are presumably rights which are 
granted to all Americans, regardless of what State they happen to 
live in. We have a Federal Constitution which grants rights upon 
the basis of American citizenship, not upon the basis of what State 
you happen to be a citizen of. 

I think these protections are important. I know that gentleman 
is a distinct conservative and cares, as I do, about the rights of 
individuals, so I am puzzled at his views. 

Mr. Geller, I wanted to ask you to straighten something out for 
me if you could. It is my understanding that the administration is 
supporting legislation which would overturn the effect of the Stan- 
ford Daily decision. Is that right? 

Mr. Geller. That is correct. 

Mr. Kostmayer. It is my understanding also that the Depart- 
ment of Justice did file with the Supreme Court at the time that 



181 

case was heard a friend of the court brief supporting the eventual 
ruhng which you now seek to overturn. Is that right? 

Mr. Geller. That is correct. 

Mr. KosTMAYER. Is that a contradiction or simply a change of 
policy? 

Mr. Geller. Mr. Heymann, the Assistant Attorney General, 
stated that, whatever the constitutional issue — and the issue before 
the Supreme Court was one of constitutional law and involved 
construing the first and fourth amendments — the Court in that 
case did invite the Congress and, correspondingly, the administra- 
tion to look at it from the point of view of policy. The administra- 
tion did look at it from the point of view of policy and concluded 
that the policy embodied in the Stanford Daily decision could have 
a chilling effect upon the press in many ways. You are familiar 
with those considerations. 

Therefore, the administration said, as a matter of policy, let us 
urge Congress to take steps to redress the situation. 

So I think the difference is between what is the constitutional 
requirement and the requirements the Congress can establish as a 
matter of policy. 

Mr. Kostmayer. In any event, you are opposed to the ruling of 
the court and support legislation to overturn its effect? 

Mr. Geller. The effect of the ruling is unfortunate because it 
does erode the rights of people engaged in disseminating informa- 
tion to the public. It is very important to take remedial action. 
That is why the administration has proposed such action. 

Mr. Kostmayer. It is my understanding — again, correct me if I 
am wrong — that telephone records are not included under this 
legislation. It would still be possible, for example, for the FBI to go, 
in my case, to Bell of Pennsylvania and obtain my telephone rec- 
ords without my consent or my knowledge. 

Is that correct? 

Mr. Geller. That is correct. But the reason why telephone rec- 
ords are not treated in this legislation is not that there is no 
serious privacy issue raised by access to these records. We agree 
that there is. But a case is now pending before the Supreme Court. 
It was argued last week. In that case, it has been urged that 
obtaining such records without a search warrant violates the 
fourth amendment. 

We are awaiting the decision in that case before we consider 
again the privacy issues involved in this situation. We do not 
disagree that there are substantial privacy issues involved in tele- 
phone toll records. 

Mr. Kostmayer. Apparently that is the position of the Depart- 
ment of Commerce. But I gather it is not the position of the 
Department of Justice. Mr. Civiletti was before our subcommittee 
some time ago and expressed a view which I think is contrary to 
yours. I do not want to speak for him, although I am. He expressed 
the view that the Federal Government did have a right to obtain 
these telephone records and that there was not a fundamental 
issue of privacy concerned. 

I would hope that you would, pending this decision that you are 
speaking of, address the situation. It seems to me there is very 
little difference between these types of records whether they are 



182 

insurance records or employment records — which I understand are 
not covered also generally; employment records. I guess insurance 
records are. In some cases academic records are. Telephone records 
are not. 

In that sense, I think the administration's proposals are woefully 
inadequate and do not go nearly far enough in including telephone 
records. So, I hope you will consider that. 

Mr. Geller. We will certainly consider the issue of telephone toll 
records. It is an important privacy issue. As I say, after the Su- 
preme Court's decision, we will have to consider it. We agree with 
you that it raises very serious issues. 

Mr. KosTMAYER. I hope you will speak with Mr. Civiletti and 
straighten him out about that. 

The Stanford Daily legislation apparently does not cover third 
parties, as the subcommittee, as you know, recommended; it only 
covers newsmen and certain professionals under your proposed 
legislation. Can you explain that omission? 

Mr. Geller. That decision was made because the area is trouble- 
some. It is troublesome, I am told, from a constitutional point of 
view. It is troublesome also because very often third parties have 
very close connection with alleged criminal activity. Therefore, 
these third parties can become in a manner of speaking, sanctuar- 
ies or havens in which information could be stored and which could 
not be searched. 

Mr. KosTMAYER. Would not it be better to err on the side of 
being too fair and too equitable rather than on the side of the 
Government? 

Mr. Geller. I can only state that the Department of Justice, 
which looked at this and is the expert agency thought that it raised 
great difficulty. Even when they evaluated doctor-lawyer or other 
particular relationships, they found it was difficult to draw the 
line: What would you put within, what would you leave out? 

The step was taken here because it is so important in the first 
amendment area. That was defined very broadly as all those en- 
gaged in disseminating information to the public. 

To carry it further and apply it to all third-party searches raises, 
as I say, the issue of sanctuaries. It raises two constitutional issues. 

For that reason, it was decided that, while the area deserved 
further study, it was not appropriate to weight down this particu- 
lar legislation with that type of difficulty. 

You recall that, after Brandenberg, because of all the various 
issues, nothing was done. It may have been unfortunate, but no 
legislation was passed. The area may be satisfactorily taken care of 
now under the Attorney General's guideline. 

But I think, as a matter of policy, it was decided to focus on the 
essential first amendment area and not to try to broaden it to 
cover everything and perhaps end up with nothing. 

Mr. KosTMAYER. Would you agree that because of that the 
burden of protecting one's privacy is now on the citizen rather 
than on Government? 

Mr. Geller. In the third-party area? There is certainly no protec- 
tion being proposed by the Government in that area. The law as it 
stands today is the Stanford Daily situation. That case would still 



183 

be applicable in the case of third-party searches. It did not involve 
this first amendment area. 

Mr. KosTMAYER. Again, I think that your proposals are good. I 
sympathize with them. Bu I think in this regard, as well as the 
area of telephone records, that they really do not go far enough; 
and they are inadequate. I think generally, if we are going to err, 
we should on the side of individual privacy rather than on the side 
of the Government. 

Thank you, Mr. Chairman. 

Mr. Preyer. Let me suggest at this time that we ask Mr. Libassi 
to join Mr. Geller, and I hope Mr. Geller will be able to stay with 
us a little longer. 

Mr. Libassi is general counsel of the Department of Health, 
Education, and Welfare. His statement will relate primarily to the 
medical records provision, an area in which we have already had 
some questions. 

Mr. Libassi, your statement will be made a part of the record, 
without objection. You may summarize it or any particular aspects 
of it that you wish. 

STATEMENT OF PETER LIBASSI, GENERAL COUNSEL, DEPART- 
MENT OF HEALTH, EDUCATION, AND WELFARE; ACCOMPA- 
NIED BY DARREL GRINSTEAD, ACTING ASSOCIATE GENERAL 
COUNSEL 

Mr. Libassi. Thank you, Mr. Chairman. 

My name is Peter Libassi. I am General Counsel of the Depart- 
ment of Health, Education, and Welfare. I am accompanied by Mr. 
Darrel Grinstead, the Acting Associate General Counsel of the 
Department. 

Mr. Chairman, I would particularly like to thank the committee 
for the opportunity to present the Department's and the adminis- 
tration's views. I would also like to thank Mr. Geller for so gra- 
ciously absorbing the committee's heat. There may be a little left 
for me, but I do want to thank him for that. 

I will now review some of the issues. 

President Carter on Monday of this week sent to the Congress a 
message outlining a comprehensive national policy to protect the 
privacy of individuals in this age when personal information is 
increasingly available. The protection of the privacy of medical 
information is an important part of the President's overall pro- 
posal. 

The President's initiative is based in large measure on the rec- 
ommendations of the Privacy Protection Study Commission, estab- 
lished by Congress to study the information systems including 
those in the health care field. We believe we have struck the 
proper balance between the often conflicting needs for privacy and 
the needs for information. 

The information in medical records is uniquely personal. To 
enable physicians and other health professionals to make diagnos- 
tic and therapeutic decisions, a patient must often reveal intimate 
personal matters. Medical developments have increased the 
volume, complexity, and sensitivity of the personal information in 
medical records. 



184 

At the same time, social and technological developments have 
weakened the traditional protections for the confidentiality of this 
information. The physician's ethical standards have traditionally 
protected the patient's confidences. State legal protections, such as 
the physician-patient privilege, have provided additional protec- 
tion. 

But now health care is often provided in a more impersonal 
setting. Traditional ethical standards and controls on access to 
patient records have been greatly eroded. The computer, of course, 
has contributed in large measure to this problem. 

The administration has therefore concluded that legislative pro- 
tections are needed to supplement these traditional protections. 
Our proposal provides for the basic protections that all our citizens 
ought to have with respect to their medical records. The mainte- 
nance, use, and disclosure of medical information has become a 
national business. It requires the comprehensive, systematic ap- 
proach that can only be provided by Federal legislation. 

Our bill follows the basic principles which have been outlined by 
Mr. Geller. First, it is to establish a code of fair information prac- 
tices for the holders of medical records and, two, to place limits on 
Government access to private medical information. 

Title I of the bill provides that medical care facilities must treat 
information which they maintain about their parties under certain 
specific prescriptions. It would cover all hospitals and all nursing 
homes. In short, it would cover all inpatient facilities. It would also 
cover, to the extent provided by regulations issued by the Secre- 
tary, that outpatient facilities which receive funds under particular 
Federal programs would be covered. 

This title would also cover Federal hospitals. The Privacy Act 
would be amended so that disclosure and patient access provisions 
of this act would replace those of the Privacy Act for Federal 
hospitals. 

Hospitals operated by State and local governments which do not 
receive Federal funds would not be covered. 

Under the bill, patients would be able to see their records or 
designate others to do so for them and would be able to obtain 
copies of materials in their files. Since there may be instances in 
which prudent medical judgment concludes that direct access by 
the patient would be harmful, the bill authorizes the medical care 
facility to channel that record through a third party designated by 
the individual. 

A patient would now be permitted under our bill to seek correc- 
tion of his medical records. The facility would have to make the 
correction or permit the patient to file a concise statement setting 
forth the patient's view. 

The administration's proposal establishes an expectation of confi- 
dentiality for medical records. Disclosure of information about a 
patient is prohibited unless the patient consents or unless the 
disclosure falls within certain specified exceptions. 

The disclosures permitted without consent fall into four general 
categories. 

First is the disclosure in the normal operation of the institution 
as part of its daily procedures, or when needed for the patient's 



185 

care, or a close relative wishes to have access to the information 
about the patient. 

The second category deals with situations in which disclosure 
about the specific patient is needed but the patient's identity is 
incidental to the use of the record. Research, audit, and certain 
uses for payment programs fall into this category. 

Third is disclosures which may affect the individual, but where it 
would thwart the purpose of the disclosure to seek consent, such as 
law enforcement purposes. Some of these disclosures have specific 
procedural safeguards to protect the rights of individuals. 

Fourth is disclosures within the Federal Government, where con- 
sent requirements would create excessive administrative burdens. 

We have given a great deal of thought, Mr. Chairman, to the 
framing of these nonconsent disclosures and the conditions sur- 
rounding them. 

The Privacy Commission noted the tension between society's in- 
terest in protecting medical confidentiality on the one hand and its 
legitimate needs for access to medical records on the other. This 
conflict is not easy to resolve. However, we believe those exceptions 
we have suggested in the administration's bill are appropriate and 
will not unduly impinge on the individual's privacy rights. 

I would like to speak to a number of these authorized disclosures 
which are necessary to achieve important societal goals. 

Certainly no one can deny the need for health research, and our 
bill would preserve the ability of researchers to obtain needed 
information from medical records. At the same time, the bill would 
impose a number of obligations on facilities and researchers to 
assure that information, once made available for a research pur- 
pose, is not redisclosed to others for nonresearch purposes that may 
adversely affect the individual. 

The Public Health Service and the Food and Drug Administra- 
tion need information from medical records to fulfill their regula- 
tory missions and to protect the public health. Federal and State 
health payment programs as well as private insurers need that 
information to administer and protect the fiscal integrity of their 
programs. Accordingly, under these circumstances, information 
would be made available without the patient's consent. 

Patient consent is not feasible in many of these cases or it can be 
obtained only with extraordinary expense and delay. Since, in most 
cases, the patient is not the target of the inquiry requiring access 
to the record, the degree of protection required is somewhat less 
than if the Government is seeking information for purposes direct- 
ly related to the individual. 

We believe that the incidental risk to the individual's privacy 
presented by such disclosure is outweighed by the public's benefit 
in permitting it. The restrictions in the bill on redisclosure of 
medical information so obtained should adequately protect individ- 
ual interests. 

Title II deals with the limits of Government access. 

Title II spells out the circumstances under which Federal and 
State authorities may obtain information from health records held 
by any health care provider. Let me emphasize here that title I 
deals with health facilities. It sets forth in title I the circumstances 
under which a health facility may disclose information. 



186 

Title II provides restrictions on the Government's access to that 
information, whether held by a health facility or by a private 
physician. 

So, title II establishes limitations on the Government's rights to 
ask a private physician for access to a private medical record. 

Title II is meant to protect the records of individuals served by 
anyone who provides health services including physicians, dentists, 
nurses, psychiatric social workers, and clinical psychologists, for 
example. This title does not impose new responsibilities on these 
providers. It does impose obligations on the Government authori- 
ties who seek access to these medical records. 

Title II permits Government authorities to obtain information 
for research, audit, evaluation, medical emergencies, care of the 
patient, payment of claims, and other uses for which disclosure is 
authorized under title I. 

The conditions surrounding such access are similar to those gov- 
erning disclosure in title I. For example, a Government agency 
receiving information for research must give all assurances and is 
bound by the same restrictions on reuse that a private researcher 
would be bound by. 

Attempts by Government agencies to obtain information by sum- 
mons, subpena, search warrants, and formal written request, under 
circumstances not otherwise permitted by the bill, would be subject 
to a number of procedural protections. 

It is the purpose of these protections to assure that, where appro- 
priate, the individual whose record is sought has an opportunity to 
be heard before a court. The authority would have to notify the 
individual in advance that it wanted the medical information con- 
cerning him. The individual would have an opportunity to chal- 
lenge in court the authority of the Government agency to obtain 
his record. 

These notice and challenge provisions could be waived by a court 
where prior notice would likely result in the destruction of evi- 
dence, flight from prosecution, physical danger to anyone, or would 
otherwise seriously jeopardize the Government investigation. 
Notice to the patient could also be waived in certain emergency 
circumstances if within 5 days of obtaining such access the Govern- 
ment agency filed in court a sworn statement setting forth the 
nature of the emergency. 

As for enforcement, again Mr. Geller outlined the administra- 
tion's general proposals with respect to enforcement. I would 
simply like to say that we want to avoid the necessity of creating 
new Federal enforcement mechanisms. 

So, although Federal funds can be terminated where there is 
substantial noncompliance, the primary enforcement mechanism 
would be through private civil suits brought by the aggrieved indi- 
vidual in Federal or State courts. 

We believe this enforcement approach is preferable not only 
because it will not require the expansion of Federal agencies and 
work forces, but also because the protection of privacy rights is 
uniquely suited to private enforcement. 

With respect to the relationship to other laws, it is the intent of 
our proposal to permit all existing statutory and regulatory protec- 
tions for the confidentiality of medical records to remain in force. 



187 

For example, the statutes governing the confidentiality of infor- 
mation on drug and alcohol abuse patients provide more stringent 
protections for these patients than our proposal does. These more 
stringent protections would be preserved. 

I wish to pick up now on the question of burden on facilities. 

In these days of rapidly rising health care costs, we believe it is 
important to minimize the administrative burdens on health care 
facilities. We believe we have designed these proposals with care to 
avoid unnecessary recordkeeping, notifications, and other paper- 
work. Likewise, we have avoided prescribing administrative proce- 
dures such as requiring appeals systems within a hospital. 

This bill will permit medical care facilities to build on their 
existing recordkeeping procedures with a minimum of additional 
effort and expense. 

In conclusion, let me say that the protection of the privacy of 
individuals with respect to medical information cannot depend 
solely on one statute or even a set of statutes. We need a strong 
commitment to the right of privacy and the careful design and 
management of record systems. These cannot be compelled by law. 
Nevertheless, sound legislation will provide the essential legal 
framework for the protection of individual privacy. 

I would be happy now to answer questions from the members of 
the committee. 

Mr. Preyer. Thank you, Mr. Libassi. 

You have indicated the problems in striking a balance between 
privacy and all of the other public interests. It certainly makes for 
a more complicated bill. As the opening statement said with regard 
to Hippocrates, he said, "Whatever should be kept secret, whatever 
should be kept quiet, I will keep secret— period." Hippocrates, 
where are you now that we need you? 

You alluded to the uniquely personal side of medical records, 
which may include information about alcoholism or sexual activity 
or psychiatric problems. Yet, I notice that you use the same stand- 
ard as far as law enforcement agency access to medical records 
goes as is used in the Right to Financial Privacy Act, the same 
standard as is used with bank records. 

Don't you think medical records are more uniquely private than 
bank records? Should we have a different standard between the 
two? 

Mr. Libassi. It is the administration's position at this time, Mr. 
Chairman, that we should consider a uniform set of standards and 
test these, explore with the committees of Congress the appropri- 
ateness of these standards, and proceed with them on a uniform 
basis for the time being. 

Should the experience dictate that there ought to be some modi- 
fication, we should consider it. But we have to remember that 
there are serious law enforcement problems requiring access to 
medical records, particularly in the prevention of fraud and abuse 
in Federal programs where extensive Federal funds are available 
to finance the care being provided to patients. On that basis, we 
feel that it is essential that we preserve access to these records on 
the same basis as we do for the other areas. 

Mr. Preyer. But you do make an exception for fraud and abuse 
access to the records, I believe, in the bill? 



56-421 O - 80 — 13 



188 

Mr. LiBASSi. Yes 

Mr. Preyer. Generally speaking, there is not the general law 
enforcement need to have access to medical records as there is in 
bank records, is there? There is a government need to check fraud 
and abuse using medical records, but hardly a general law enforce- 
ment need; is there? 

Mr. LiBASSi. You are correct, Mr. Chairman. I agree with you 
that the general law enforcement programs perhaps are in greater 
need for financial and banking records than they may be of medi- 
cal records. But the Federal Government and State Governments 
do have substantial need for access to these records in connection 
with the programs which are now funded by the Federal Govern- 
ment. 

Mr. Preyer. I gather then that your position is flexible. You will 
wait and see how it develops, whether the law enforcement stand- 
ard applying to bank records should be the same as that applying 
to medical records? 

Mr. LiBASSi. Yes, Mr. Chairman. 

Mr. Preyer. Mr. Kindness made the good point earlier today 
that we should benefit by concrete examples of ongoing programs. 
Under the Privacy Act, individuals are allowed to inspect medical 
records maintained by Federal agencies. 

I wonder what learning we can get from that. Has HEW imple- 
mented any special procedures to implement that provision? What 
has been our experience with that? 

Mr. LiBASSi. The experience of the Department to date has been 
positive, Mr. Chairman. Records held by HEW hospital facilities 
have now been made available to the patients, so they have an 
opportunity to examine their own records. 

Mr. Preyer. Have many people taken advantage of that opportu- 
nity? 

Mr. LiBASSi. There have not been the number of requests by 
patients to examine their own records that was anticipated when 
the legislation was first considered. For instance, at the NIH clini- 
cal center we have 115,000 records, and we had 400 requests in 
calendar year 1978. That is a little more than one request per day 
for the opportunity of patients to examine their records. 

At PHS hospitals and clinics we have over 6 million records. We 
have had about 10,000 patients who had requested an opportunity 
to examine their records. 

At St. Elizabeths Hospital, we have a situation in which we had 
only 44 requests for patients to examine their records. But we 
believe that is because the patients are apprised of their records, 
and their records are used as part of the treatment program. So, 
that may be an unusual situation at St. Elizabeths. 

In our New Orleans Hospital, which is a 300-bed hospital, we 
have had only 10 requests a year from patients for an opportunity 
to examine their records. 

So, the requests of patients to examine their records has not 
been inordinate. At the same time, I would say that it is a positive 
part of the patient's treatment program to have access to their 
records. As you are well aware, Mr. Chairman, the access to pa- 
tient records is not uniform across the country. In many States, 



189 

there are no provisions to assure patients that they can have access 
to their own records. 

Mr. Preyer. How about the history of withholding records from 
individuals because of concern that it might have unfortunate con- 
sequences, perhaps medical consequences, to the individual? Are 
there any lessons to be learned about how widespread that is or 
whether that is a problem? 

Mr. LiBASSi. We do not have statistics, Mr. Chairman, on the 
number of requests which have been filled through third parties 
other than the reported impressions to us that this is rare, quite 
infrequent, and that, generally speaking, the information is made 
available directly to the patient. 

Mr. Preyer. Thank you, Mr. Libassi. 

Mr. Kindness. 

Mr. Kindness. Thank you, Mr. Chairman. 

Mr. Libassi, I noticed that in title III general provisions, section 
301, it would create a new crime, a misdemeanor with respect to 
any person who under false pretenses requests or obtains medical 
information concerning an individual from a health care provider. 
It says he shall be guilty of a misdemeanor and upon conviction 
shall be fined no more than $10,000 and not more than one year 
imprisonment. 

Could you explain to us the thought process or the judgmental 
process involved in arriving at that proposal? And does it relate to 
any other existing statutory provision with respect to penalties on 
a comparative basis? 

Mr. Libassi. I am not able to answer the second part of your 
question as to how this section of the law relates to other sections. 
I do not know whether or not we have any additional information 
on that in terms of where this type of penalty may exist in other 
statutes. 

If I can, I would like an opportunity to submit for the record a 
memo on any other Federal laws with similar provisions. 

[The memo follows:] 



190 




DEPARTMENT OF HEALTH. EDUCATION. AND WELFARE 

OFFICE OF THE SECRETARY 
WASHINOTON. D.C. KMt 



APH 19 1979 



MEMORANDUM 



TO 



FROM 



Peter Libassi 
General Counsel 



Darrel Gri 
Attorney Ad 



OFFICE OF THE 
CENERAL COUNSEL 




SfflCE OF THE SnEML COURa 



AM ^^ 

7^8i9,mm2|li2i3iM J 



SUBJECT: Obtaining Medical Information Under False 
Pretenses 



When you testified on April 4, 1979 before the Sub- 
committee on Government Information and Individual Rights 
of the House Committee on Government Operations on the 
Administration's proposed Privacy of Medical Information 
bill, you were asked whether there were other Federal 
laws comparable to section 301 of our bill, which would 
make it a misdemeanor for anyone, under false pretenses, 
to request or obtain medical information concerning an 
individual from a health care provider. This memorandum 
addresses that question. 

The model for section 301 is contained in the Privacy 
Act of 1974, 5 U.S.C. 552a(i)(3) which provides as 
follows: 

(3) Any person who knowingly and willfully 
requests or obtains any record concerning an 
individual from an agency under false pretenses 
shall be guilty of a misdemeanor and fined not 
more than $5000. 

The authority of the Federal Government to impose crim- 
inal penalties for such an offense is, of course, based 
on the fact that the records covered by the Privacy Act 
are in the hands of a Federal agency. 

Both the Comprehensive Alcohol Abuse and Alcoholism 
Prevention, Treatment and Rehabilitation Act of 1970 and 
the Drug Abuse Office and Treatment Act of 1972 have 
provisions designed to protect the confidentiality of 
the records of any patient maintained in connection with 



191 



the performance of any alcohol or drug abuse prevention 
or treatment activity "conducted, regulated or directly 
or indirectly assisted by any department or agency of 
the United States." (21 U.S.C. 1175 and 42 U.S.C. 4582) 
Both of those stautes contain criminal penalties for 
violations of those confidentiality provisions. (21 
U.S.C. 1175(f) and 42 U.S.C. 4582) (f)) 

However, unlike section 301 of our proposal, the reach 
of the protections in the alcohol and drug abuse acts 
is only with respect to records for which there is some 
connection with the Federal Government. 

Section 301 goes beyond the above described provisions 
and would impose Federal criminal penalties on anyone 
who requests or obtains medical information about an 
individual under false pretenses, regardless of whether 
there is any Federal interest in the records. Our pro- 
posal for criminal penalties for this offense is based 
upon the finding that the practice of obtaining medical 
information under false pretenses affects interstate 
commerce and is therefore within the reach of Federal 
power . 

The closest analogy to our proposal in other areas is 
the Fair Credit Reporting Act which contains the follow- 
ing criminal provision in section 619: 

Any person who knowingly and willfully obtains 
information on a consumer from a consumer report- 
ing agency under false pretenses shall be fined 
not more than $5,000 or imprisoned not more one 
year, or both. (15 U.S.C. 1681q) 

This provision is based, presumably, on the effect of 
consumer credit reporting practices on interstate com- 
merce. See section 602 of the Fair Credit Reporting 
Act, 15 U.S.C. 1681. */ 



77 The term "consumer reporting agency" is defined in 
15 U.S.C. 1681 a(f) as any person engaged in assembling 
or evaluating consumer credit information and "which 
uses any means or facility of interstate commerce...." 



192 



While our proposed section 301 does not require a show- 
ing of any effect on interstate conunerce to establish a 
violation, it is clear from the Report of the Privacy 
Protection Study Conunission that the safeguarding of the 
confidentiality of medical records is an interstate 
problem. See Chapter 7 of the Report of the Privacy 
Protection Study Commission, Recommendation (4), p. 294. 
We expect the Congressional hearings on this proposal to 
uncover additional evidence of the effect on interstate 
commerce of confidential medical information obtained 
under false pretenses. 

The Supreme Court has upheld criminal statutes based on 
the interstate commerce clause- even where there was no 
showing of an effect on interstate commerce in the par- 
ticular case before the Court. In Perez v. United States , 
402 U.S. 146 (1971), the Court upheld an anti-loan shark- 
ing statute, 18 U.S.C. 892, on the basis of Congressional 
findings, reflected in the legislative history of the 
statute, that extortionate extensions of credit affect 
interstate commerce, principally through the support 
such practices provide for organized crime. The Court 
observed at 402 U.S. 154: 

Extortionate credit transactions, through purely 
intrastate, may in the judgment of Congress 
affect interstate commerce. 

Therefore, it is reasonable to conclude that, if the 
legislative history of the privacy of medical infor- 
mation legislation demonstrates that obtaining medical 
information under false pretenses affects interstate 
commerce, a provision such as section 301 would be found 
to be within the legislative power of Congress. 



193 

Mr. LiBASSi. As you point out, Mr. Kindness, this provision does 
make it a crime for an individual to obtain information under false 
pretense. What is intended here is to protect against a situation 
where an individual goes to a private physician, pretends to be a 
law enforcement officer or pretends to be an insurance company 
representative, and on that basis asks the private physician for 
information. The private physician, relying on the representations 
of the individual, makes that information available. 

At that point the person who has requested and secured that 
information would have been guilty of a crime. 

The law does not place any obligations on the physician. It does 
not require the physician to disclose that information. But, if the 
physician should, the individual who sought that information 
would have committed a crime and would be subject then to these 
penalties. 

Mr. Kindness. I have a preoccupation these days with the efforts 
to codify the Federal criminal laws. I am having a little difficulty 
fitting this into the context of any of the proposals exactly for 
criminal code. 

We are talking only about false pretenses and only about health 
care providers and not about health care facilities. I am trying to 
get the Federal connection that is presumably necessary to estab- 
lish such a misdemeanor. 

We are not necessarily talking about interstate commerce. So, we 
do not hinge it on the commerce clause. What is this hinged on? 

Mr. LiBASSi. Mr. Kindness, let me say first that a health care 
provider includes, by our definition, a health care facility as well as 
the private physician's office. So, if anyone went to a hospital or a 
physician's office or a dentist's office, they would be covered; they 
would have committed the same offense. 

On page 46 of the bill, we define health care provider to include 
all medical care facilities as described above as well as any person 
providing health services. 

I think we would like an opportunity with the Department of 
Justice to consider further this issue. And this may be modified. 
When the criminal code revisions are worked on by the Depart- 
ment of Justice and the Congress, this particular section may be 
modified. So, I am not in a position to 

Mr. Kindness. Oh, it will be. 

Mr. LiBASSi. I think we would want to reserve with you the 
opportunity to discuss how this provision and the criminal code 
provisions then might be made to conform. 

I did want to indicate that there are standard procedures in 
which anybody misrepresenting themselves to any health care pro- 
vider or facility would be subject to these penalties. 

Mr. Kindness. Thank you. 

Then, in the following section on civil suits, some new law is 
proposed whereby there would be a right to bring an action in a 
U.S. district court without regard to the amount in controversy or 
in any other court of competent jurisdiction. 

I am uncertain as to whether a State court would be a court of 
competent jurisdiction with respect to this particular proposal if it 
became statutory law. Let us assume for the moment that most of 
the cases would be brought in Federal courts. We are establishing 



194 

some new concepts really in the proposal here as to what damages 
would be recovered. All actual damages — as a matter of fact, the 
language at the bottom of page 41 of the bill says that a violator 
shall be liable to the aggrieved individual for all actual damages 
sustained by the individual. Then it goes on to provide for sort of 
punitive damages of not less than $100 nor more than $10,000. 

Could you give us the rationale for including this provision in 
the bill? 

Mr. LiBASSi. Mr. Kindness, it may be difficult to establish the 
actual damages for the invasion of a person's privacy. It might be 
argued that it was of no consequence that his privacy was invaded, 
that he suffered no monetary damage, he lost no time at work, he 
has not been publicly humiliated. Therefore, the right to protection 
from invasion of one's privacy would be undermined because there 
was no way to impose a sanction on the organization or institution 
that improperly invaded the privacy. 

A researcher who rediscloses the information to other persons for 
inappropriate reasons could come in and, as a defense, say that 
there is no damage suffered. So, the general damage provision was 
added as a way of attempting to put some teeth into the protection 
of the rights of privacy of the individual. 

Mr. Kindness. This is presumably going to include the United 
States of America, the States, perhaps local governmental entities 
conceivably. And these actions can be brought against these gov- 
ernments as well as individuals. 

Am I correct? 

Mr. LiBASSi. Yes, sir. 

I believe, where a State has waived its sovereign immunity, then 
the State would be subject to these proceedings. Where it has not 
waived its immunity, then the officer or employee would be subject 
to suit. 

Mr. Kindness. By passing this law, we would not be saying 
somehow that the States were deemed to have waived their immu- 
nity? 

Mr. LiBASSi. No, sir. 

Mr. Kindness. Thank you. 

Thank you, Mr. Chairman. 

Mr. Preyer. Mr. Weiss. 

Mr. Weiss. Thank you, Mr. Chairman. 

Mr. Libassi, in your listing of the exceptions, I think the last 
exception that you stated was something to the effect that, where 
failure to have availability of those records would in essence injure 
the case that the Government had, or some such, could you go 
through that? 

Mr. LiBASSi. These were the situations in which disclosure would 
be permitted? 

Mr. Weiss. That is right. 

Mr. LiBASSi. Without the patient's consent? The last one was 
disclosure within the Federal Government, where consent require- 
ment would create excessive administrative burdens. 

Mr. Weiss. No. 

Mr. Libassi. Disclosure which may affect the individual but 
where it would thwart the purpose of the disclosure to seek con- 
sent. These are law enforcement purposes where there would be 



195 

some disclosure, but there would be specific procedural safeguards 
to protect the rights of the individual. 

And then the second one was disclosure in which the specific 
identity of the patient may be needed but is incidental to the use of 
the record. That is in connection with research and audit. 

And then the first one was, disclosure in the normal operation of 
the institution. 

Mr. Weiss. I guess it was the third one then. 

Mr. LiBASSi. Disclosure which may affect the individual but 
where it would thwart the purpose of the disclosure to seek con- 
sent. And that is basically law enforcement purposes where the 
individual either might flee the jurisdiction or the evidence might 
be destroyed. Then the law enforcement office could seek the infor- 
mation without consent of the individual. 

Whenever the Government is seeking access for law enforcement 
purposes which are not provided for elsewhere in the bill, they 
must then go before a court and indicate why notice is not 
required. 

Therefore, we are trying— as Mr. Geller indicated earlier— to 
establish ground rules that will govern how the Federal/State 
agencies secure information without consent. There are certain 
specific cases where they may seek it without consent. There are 
other cases where they must obtain consent. 

If they feel there is some extraordinary reasons why they should 
not have to consent of the patient, they must go before a court; and 
the court must agree that they should have access to that informa- 
tion without the patient's consent. 

Mr. Weiss. At one point I think there was mention of exception 
in instances of foreign intelligence? How is that formulated? 

Mr. LiBASSi. The Central Intelligence Agency would have the 
right under the bill, where national security issues were involved, 
to gain access to a patient's medical record held by a facility or by 
a provider. The bill also provides that, where the Central Intelli- 
gence Agency seeks that information, the patient may not be ad- 
vised of that fact by any of the employees of the facility or the 
provider. 

So, there could be, under this bill, absolute secrecy in the access 
of the information by the CIA and no disclosure to the patient by 
anyone that they had access to the record. 

Mr. Weiss. You mean that, if the CIA, for whatever reason- 
good, bad, or indifferent— decided that it wanted to get the records 
of the patient at a particular psychiatrist's office, it would have the 
right to go in and get that information without notifying the pa- 
tient; and the doctor would have no right to refuse to turn the 
information over? 

Mr. LiBASSi. I want to be careful on this. Under this law, no new 
obligation to disclose is provided. This law does not impose any new 
obligations on any facility or provider to make information availa- 
ble. If they are not required to make it available under some other 
law, they are not required to make it available under this law. This 
law only sets forth the procedures that should be followed in 
making the information available and the procedures that should 
be followed in seeking it. 



196 

So, if a physician or a hospital is not required to make the 
information available to the CIA, this proposed bill does not impose 
that obligtion. 

I am not in a position to say under what rules and under what 
circumstances the CIA has an absolute right to information. I 
cannot answer that question, and I do not know what statutes 
govern the CIA. 

Mr. Weiss. In the course of an earlier discussion, Mr. Geller had 
said that there is no burden placed upon any physician in this 
legislation; that the only thing that is done really is to provide 
some protection to the doctor so that the doctor, if an FBI agent 
came along or someone else flashing a badge, would know that 
there is no mandate to turn over the information because this 
legislation specifically provided that information did not have to be 
disclosed. 

Now what you are saying in essence is that that may very well 
be true, but, in the case of the CIA, the physician in that instance 
really would not have that built-in protection. Indeed, quite the 
opposition, implicitly, the CIA would have the right to demand that 
record; and the doctor would in essence be taking a gamble as to 
whether in fact he or she should or would have to turn those 
records over. 

Mr. LiBASSi. Mr. Weiss, let me say that this statute requires that, 
if a Federal agent approaches a physician or a hospital on the 
grounds of conducting foreign intelligence or counterintelligence 
activities, they must provide to the facility in writing a certifica- 
tion that the document is needed for those purposes. That certifica- 
tion has to be signed by a supervisory official of rank designated by 
the head of that agency. 

At that point the hospital or the physician may or may not turn 
over the information. This law does not require them to do that. 

I do not know whether or not other statutes may. But, under the 
bill that is proposed by the administration, the hospital or the 
physician is under no additional obligation to turn that informa- 
tion over. They may demand from the CIA agent in writing that 
the agent certify that the information is need for these purposes. 
In fact, the Federal agent would be violating this statute if they 
went in and said, "I am a CIA agent; I would like so and so's 
record." They must provide written certification to the holder of 
the record that they are authorized by the head of the agency to 
seek that information. 

So, in essence, what we are doing is placing a limitation on the 
Federal Government as to what circumstances and under what 
conditions it may seek medical records for foreign intelligence and 
counterintelligence activities. 

This bill does not require the holder of the record to turn it over. 

Mr. Weiss. Would you not think, Mr. Libassi, that, since there 
seems to be some vagueness about that whole area, and it appar- 
ently would require the physician to have an awareness of that fact 
that you have just stated on his own, that perhaps the legislation 
itself ought to specifically state: Provided, however, that nothing in 
this provision mandates any facility or physician to turn such 
information over to such agent unless otherwise required by some 
other law? 



197 

Mr. LiBASSi. I agree with you. Yes. If it doesn't, it certainly 
should. 

I hope that I can find the section where it does. But, if we do not 
find it, I would agree with you that it ought to make it expUcit that 
this statute does not impose any new obligations to disclose. 

Mr. Geller. May I add to Mr. Libassi's answer? There is an 
annual tabulation of all such requests. These are, as he said, ex- 
emptions from procedures. When the process is used, when the 
certificate is given, there is to be an annual tabulation of the 
occurrences submitted to the appropriate congressional committees 
either by the Secret Service or by the foreign intelligence agencies, 
such as the CIA. 

So, it does go to the Congress. The Congress has oversight in the 
area of what is going on. 

Mr. Weiss. Mr. Geller, with all due respect, that same require- 
ment exists as far as the electronic surveillance legislation is con- 
cerned. But, if those records indicate anything at all, it is that 
invariably— I think just about 100 percent or 99.999 percent of the 
time — the application is granted. 

I do not know what that recordkeeping really does as far as 
providing protection for the individual patient or the individual 
doctor who is faced with an immediate situation. 

Mr. Geller. All we are saying is that Congress at least is given 
the information so that it can have approprate oversight over the 
activities that are involved. 

I agree with you that it does not affect at all what happens in 
the individual case. But it certainly is a check on abuse of this by 
the executive agency involved. Congress is told of it and is given an 
annual tabulation of it. 

Mr. Weiss. Let me go into an area very briefly that is not 
national security. It is hypothetical. 

Suppose you have a civilian employee of the Federal Government 
on a Federal facility which is subject to Federal laws. That civilian 
employee is driving a vehicle and gets into a very severe accident. 
Other people are killed in the course of the accident. The civilian is 
taken to a hospital because he himself is seriously injured. He is 
given all kinds of tests. On the basis of those tests there is reason 
to believe that that civilian may in fact have been under the 
influence of drugs or alcohol. 

In that instance, what would be the right of the Federal Govern- 
ment to get the records of that individual civilian employee of the 
Federal Government without his permission? 

Mr. LiBASSi. If the civilian were taken to a Federal hospital, then 
the provisions relating to the Federal facilities would apply. 

Let me consult, if I may, on this question. 

I am trying to be sure that we give a precise answer to it because 
the question, as I understand it, could involve private litigation of 
parties involving whether or not the individual was negligent. 

But your question is, would the Federal Government 

Mr. Weiss. I am talking about prosecution, really, for a violation 
of a Federal criminal statute. 

If in fact that is a complex question to give an answer to off the 
top of your head, I would be satisfied, Mr. Chairman, if the re- 
sponse were submitted in writing. 



198 

Mr. LiBASSi. I would appreciate that because I would like to be 
careful in answering it that we give you the exact answer. Then, if 
you are not satisfied with the result, you can change the legisla- 
tion. I could rather not mislead. 

Mr. Weiss. Right. You might want to, incidentally, build in some 
of the variations of that question and try to respond to it in the 
totality. I think it raises a number of questions surrounding this 
whole issue as to what in fact are the rights of the Government vis- 
a-vis the rights of the individual. That is really what I am trying to 
pose to you. 

Mr. LiBASSi. You are most concerned about the rights of access to 
a private physician's medical record by the Federal Government? 

Mr. Weiss. Right. 

And that private citizen may or may not be a Federal employee. 

Mr. LiBASSi. But the record is held by a Federal hospital? 

Mr. Weiss. By a Federal in one instance and by a non-Federal — 
suppose it was a private hospital that he was taken to. 

Mr. LiBASSi. But the question is, what right would the Federal 
Government have access to that record 

Mr. Weiss. That is right. 

Mr. LiBASSi [continuing]. Whether held by a Federal hospital or a 
non-Federal hospital? 

Mr. Weiss. Right. 

Mr. Kindness. Will the gentleman yield? 

Mr. Weiss. Of course. 

Mr. Kindness. Could we perhaps also have the view of the De- 
partment with respect to obtain access to those records for the 
purpose of personnel action? 

Mr. LiBASSi. Yes. All right. In terms of disciplinary action 
against the individual for having been under the influence of alco- 
hol or drugs at that time. 

Mr. Weiss. Right. 

Mr. LiBASSi. All right. 

Mr. Preyer. Without objection, we will leave the record open for 
your responses on this. 

I might point out that in the course of the hearings we will have 
some other witnesses that will be going into detail in these compli- 
cated areas of alcohol information and drug information. 

Mr. Weiss. Thank you, Mr. Chairman. 

[The material follows:] 



199 



The supervisors of the employee, or investigative personnel may obtain 
records in one of two ways under the proposal: 

(1) with the consent of the individual, under sec. 202(1), or 

(2) through a summons, subpoena, or formal written request, under 
sec. 202(10). 

The latter procedure requires notice to the individual, and an opportunity 
to challenge the need for the information, under requirements in sections 
203 through 206. The formal written request procedure may not be used 
unless no administrative summons or subpoena authority appears reasonably 
available to the authroity that wants the records. The notice to the 
individual may be delayed by court order (sec. 208) if there is reason to 
believe that notice will result in endangering life or safety, flight from 
prosecution, destruction of or tampering with evidence, intimadation of 
potential witnesses, or otherwise seriously jeopardizing or unduly delaying 
a trial, investigation, or official proceeding. 

In the example given, the exceptions to notice would not normally apply, 
and so the investigative authorities would be obliged to give notice and 
provide the employee an opportunity to challenge the need for the record. 
The answer would be the same in the case of a non-Federal hospital. 

If the driver were a soldier, the record could be obtained without consent, 
and without the notice procedures, by military authorities, under sec. 202(16), 

The information could also be turned over to military claims authorities 
who would seek to recover the costs of the soldier's care, if there is a 
third-party responsible for his injuries, under the Federal Medical Care 
Recovery Act (42 USC 2651-53) (sec. 202(20) of bill). 



200 

Mr. Weiss. Just as a sidelight to that kind of question, Why is 
there the exception built into the legislation which in essence 
allows uniformed services to have access to medical records of 
individuals under their control? 

Mr. LiBASSi. The Veterans' Administration and the Department 
of Defense felt that, in the normal course of their operations, they 
are constantly passing medical records back and forth for purposes 
of treatment, benefits, compensation, family benefits, et cetera. It 
would be an extreme burden to be constantly checking back with 
the veteran or checking back with the serviceman for consent to 
the continuous disclosure of these records with the Federal estab- 
lishment. 

Mr. Weiss. Thank you. 

Thank you, Mr. Chairman. 

Mr. Preyer. Thank you. 

Mr. Erlenborn? 

Mr. Erlenborn. Thank you, Mr. Chairman. 

Mr. Libassi, you have heard some of the questions I asked Mr. 
Geller. You probably anticipated I will ask some of the same of 
you. 

Let me first ask about this area of defining exactly who is the 
recipient of Federal funds. Let me give you an example to tell you 
why I have concerns in this area. A few years ago, when I was in 
the State legislature in Illinois, the director of the department of 
conservation was indicted for violating the Hatch Act. He was 
appointed by the Governor. He was paid out of the State treasury. 
But funds from the sale of duck stamps and so forth went into the 
department of conservation, were used by the department of con- 
servation. 

So, the U.S. attorney came to the conclusion that he was a 
Federal employee under the Hatch Act and indicted him because 
he was engaged in political activities. 

That is sort of a background. Plus, your Department's experience 
with title IX telling Brigham Young that they could not have rules 
to separate boys and girls in the off-campus boarding houses and so 
forth. 

Who is and is not the recipient of Federal funds under this act? 

Mr. LiBASSi. Let me, if I may, enlarge on your question and then 
try to answer it as comprehensively as I can. I want to be sure that 
I have made clear to the committee that we are proposing in this 
bill that inpatient facilities would be covered by title I of this bill 
whether or not they received Federal funds. So, all hospitals and 
nursing homes would be subject to the provisions of title I. 

They would have to make records available. They would have to 
allow patients to correct them, et cetera. 

So, wiih respect to title I of the bill, all inpatient facilities would 
be covered whether or not they received Federal funds. 

With respect to outpatient facilities — that would be clinics, for 
instance — those clinics would be covered if they received Federal 
funds and the Secretary by regulation brings them within the 
provisions of the law. 

The bill would limit the exact kinds of Federal funds that would 
bring an outpatient facility under the law. For instance, if a clinic 
received maternal and child health programs funds or community 



201 

mental health center funds, it could then be brought under title I 
by the regulations of the Secretary. We would list in the regula- 
tions those particular Federal programs that would bring an outpa- 
tient clinic under title I. 

We do not in that area include the medicaid program. So, if a 
health clinic receives only medicaid funds, they could not be 
brought within this law. 

To try to answer your question specifically 

Mr. Erlenborn. How about family planning funds? 

Mr. LiBASSi. Family planning funds 

Mr. Erlenborn. They are included? 

Mr. LiBASSi. Under the Public Health Service Act 

Mr. Erlenborn. How about the doctor who may be engaged 
through the local clinic to provide those services? 

Mr. LiBASSL If the doctor provides those services at the clinic and 
the record is at the clinic, the records held there would be subject 
to the act. But the doctor does not, by virtue of providing those 
services at a clinic, bring his entire private practice and his own 
office 

Mr. Erlenborn. What if he keeps the records in his own office? 

Mr. Libassl I would want to think about that one. 

Let me say, with respect to private physician, the intent of the 
administration is not to cover the private physician 

Mr. Erlenborn. I understand. I have heard that before. 

What I am trying to find out is, how can this be interpreted 
sometime down the road? 

Mr. Libassl Well, the regulations that the Secretary would 
issue — and here again the committee may want to strengthen the 
legislation in order to make sure that there is no question about 
how the regulations would be written — would identify the types of 
outpatient facilities that would be brought within the act. 

In the drafting of those regulations the Secretary could make it 
explicit that private physicians would not be covered even though 
they may have a record in their possession which related to these 
programs. 

Mr. Erlenborn. You do not happen to, in this legislation, pro- 
pose that the regulations be submitted to Congress and we have a 
one-House veto? 

Mr. Libassl No, we do not. 

Mr. Erlenborn. I didn't think so. 

Let me get into another area. 

Do I understand correctly from your testimony that you rely 
principally on private enforcement? In other words, if an individu- 
al feels that he has been aggrieved under this law, he has the right 
at his own expense to go into court to enforce the law? 

Mr. Libassl Yes, sir. 

Mr. Erlenborn. The only other enforcement is if there are mas- 
sive gross violations, the atomic weapon, so to speak, of enforce- 
ment, the cutoff of all Federal funds to the institution, may be 
utilized? 

Mr. Libassl That is correct. Yes, sir. 

Mr. Erlenborn. That would be rather like what is going on in 
North Carolina today, I guess. I think that is your department 



202 

again starting the process of cutting off Federal funds to higher 
education in North CaroHna? 

Mr. LiBASSi. It is similar. 

Mr. Erlenborn. Similar. 

Some people wonder who gets hurt the most when those Federal 
funds get cut off: the students who are supposed to be the recipi- 
ents—maybe, in the case of this act, the people in need of health 
care who don't get the health care because the funds are not 
forthcoming. 

Where do the private citizens get the funding to enforce this for 
their own benefit? It is strictly at their own expense? 

Mr. LiBASSi. It would be at their own expense, but the attorney's 
fees would also be available if they were successful in their litiga- 
tion. But they would 

Mr. Erlenborn. Within the judgment of the court? Or is it 
spelled out that the court must award? 

Mr. LiBASSi. It is "may." 

Mr. Erlenborn. Well, that might be an incentive to some of 
those attorneys who feel they may get compensated that way. 

As to law enforcement, title II applies to State law enforcement 
agencies as well as the Federal? 

Mr. LiBASSL Yes, sir. 

Mr. Erlenborn. And it certainly would apply to private individ- 
uals and institutions as to their right to get records? 

Mr. LiBASSL No. Title II is a limitation on Government and only 
on Government agencies. 

Mr. Erlenborn. I see. 

Title I would prohibit the individual not a Government agency 
from getting access? 

Mr. LiBASSL That is right. 

Title I provides that a facility would not and should not release 
information to a private citizen unless they have complied with the 
requirements of the act. So, it is a limitation on when a facility 
may disclose information to a Government agency or a private 
indivudual requesting it. 

Mr. Erlenborn. Do I understand, then, that title I protects the 
individual from invasion by the general public, some private indi- 
vidual? Title II protects the individual from invasion either by 
going to the doctor's records or the facility? 

Mr. LiBASSL That is correct. Title II 

Mr. Erlenborn. There is no protection then on the individual 
physician's records except against the Government agency inter- 
vention in this act. 

Mr. LiBASSL In this act. That is correct 

Mr. Erlenborn. You still have your general rules that the physi- 
cian must follow as a professional. 

Mr. LiBASSL Let me say that the physician under this act is free 
to deny disclosure of his records. No new burden is placed on the 
physician to disclose. 

If a Government agent wishes to secure a record held by a 
physician, the Government must comply with title II's procedures. 
It still does not place on the physician an obligation to disclose if 
the physician chooses not to. That would be subject to other laws. 



203 

Mr. Erlenborn. Let me pose to you what is not a fanciful set of 
circumstances but a reality you probably are familiar with in the 
Chicago area, and I am sure this may have happened elsewhere. 

Neither State nor Federal law enforcement officials, including 
HEW, seem to be doing the kind of thorough job of investigating 
the expenditures of medicare and medicaid funds. A private organi- 
zation known as the Better Government Association in association 
with the Chicago Tribune, if I recall correctly, engaged in a rather 
extensive investigation of local clinics, private physicians' offices, 
other health care providers and found widespread abuse. 

For instance, they would find that a particular physician or 
clinic was prescribing birth control pills to every man, woman, and 
child regardless of age who came into the facility or prescribing 
eyeglasses or tests to be performed by a laboratory. 

When that was publicized through the newspaper, that did gen- 
erate a good deal of law enforcement activity. I think it was very 
healthy, very healthy, because we had the BGA and the newspaper 
looking over the shoulder, so to speak, of HEW and the State of 

Illinois. 

Would this act as proposed prohibit that kind of activity by the 
newspaper and the BGA since they were looking into individual's 
records? 

Mr. LiBASSi. I believe that they would not have access to informa- 
tion which identified the individual. 

I would like to be absolutely sure about that and try to answer 
that question, if I may, for the record. But my first impression of 
the statute is that they would not have access to identifiable infor- 
mation. 

Mr. Erlenborn. So, really, the act does not condition access on 
the purpose of the person who is seeking access but is going to be a 
general prohibition. And we will find, at least in this area, that law 
enforcement agents acting properly under this act will be the only 
ones who will be able to get the kind of information as to whether 
or not the laws are being enforced. 

We are not going to have the oversight of these citizens groups or 
newspapers to provide the kind of very necessary brake on irre- 
sponsible or lack of action by Government law enforcement agen- 
cies. 

Mr. LiBASSi. Yes, that is correct. If I am in error in my conclu- 
sion, I will certainly advise the committee. But that is correct. The 
private groups and organizations would not be empowered by this 
act, would not be authorized to have access to private medical 
records for purposes of assuring compliance with fiscal integrity of 
rules for health care programs. That is correct. 

[Additional information follows:] 



56-421 O - 80 — 14 



204 



The bill is intended to permit access to individually identifiable 
records for proper audit purposes, but ot prevent indiscriminate and 
inappropriate access to records. 

In the case given, it is arguable that a hospital would be free to 
open its files to a private group if that group were conducting a true 
audit or evaluation, and if it fulfilled the conditions set out in the 
bill for such non-governmental audits, (sec. 105(b)(7).) The inquiry 
would have to be a true audit or evaluation, conducted by people pro- 
fessionally qualified to do this work, and conducted using generally 
recognized systematic audit and evaluation techniques. The personnel 
doing the audit or evaluation would have to give assurances that 
individually identifiable information would be safeguarded against 
improper disclosure, and would be disclosed only under the limited cir- 
cumstances permitted in the bill, i.e., for the purposes of the audit 
or evaluation, in health or safety emergencies, or pursuant to compulsory 
legal process. A record of the access would have to be maintained. 

The hospital would be permitted to disclose individually identifiable 
information only to the extent needed to accomplish the audit or 
evaluation. 

Thus, to the extent that the activity conducted by a private watchdog 
group meets the same standards as would be met by any other private 
audit, the activity inquired about could be permitted under the bill. 

Our bill would of course not require any disclosure for private audit 
purposes, but simply permit it. 



205 

Mr. Erlenborn. Thank you, Mr. Chairman. 

Mr. Weiss. Will the gentlemen yield? 

Mr. Erlenborn. Yes. 

Mr. Weiss. Would you also be able to tell us — and perhaps for 
the record — how this legislation ties in with the provisions of, I 
believe, H.R. 3, which was adopted in 1977, which deals specifically 
with medicare and medicaid fraud and abuse and enforcement at 
the State level with some Federal funding assistance. 

Mr. LiBASSi. I would be pleased to submit a memo on the rela- 
tionship between the administration's proposal and H.R. 3. I would 
like an opportunity to work that out with the inspector general of 
the Department. 

[The material follows:] 

We have been careful in drafting our proposal to ensure that State and 
Federal auditors would be able to gain access to individual medical 
records, without patient consent, for the purpose of protecting the 
fiscal integrity of these programs. Section 105(b3(6) of our bill 
would permit access to patient records -- 

(6) to persons presenting appropriate evidence of their official 
status who state in writing that they need the infomation -- 

(A) for a government public health investigation, for a 
government investigation of activities of the facility, 
or for a Federal, State, or local government audit or 
evaluation purpose, or 

(B) to carry out a program under title V, part B of title XI, 
title XVIII, or title XIX of the Social Security Act, or 
other government program providing payments to, or con- 
cerned with activities of, the facility, or to conduct an 
investigation concerning fraud, abuse, or waste under those 
programs . 

The only requirement on the medical care facility in connection with 
such access is that a record be maintained of each request for such 
access and that those records be made available to patients on request. 



206 

Mr. Weiss. Thank you. 

Mr. Kindness. Will the gentleman yield? 

Mr. Erlenborn. I would be happy to. 

Mr. Kindness. Thank you. 

Going down this road just a little bit further, I can see that the 
institutional review boards' members might very well say in every 
case presented to them, no we won't release the information; you 
go to court and get the court to determine the question. 

Has any thought been given to that aspect of it, particularly 
since members of the institutional review board would be subject to 
a civil action perhaps with some regularity? 

You would either have difficulty finding people willing to serve 
on such boards, or their answer would automatically be no. 

Is there a problem there? 

Mr. LiBASSi. With respect to research projects, a facility may 
make the decision to disclose or not disclose on its own. Or the 
facility may rely on the judgment of an institutional review board. 
It can be either the hospital's institutional review board or it can 
be another institutional review board which they use. 

Mr. Kindness. Excuse me. I have already concluded that the 
hospitals are going to say no in every case so that they do not have 
this additional liability. 

Mr. LiBASSi. If the institutional review board felt that the re- 
search project was not worthy of disclosure, did not feel that it was 
of such a social purpose that the person's privacy should be invad- 
ed, there is no liability for the institutional review board for refus- 
ing to make the record available. 

The only liability that might arise is if the institutional review 
board was arbitrary and capricious in allowing disclosure. Then the 
parent organization would be subject to suit, but not the institu- 
tional review board. 

Mr. Kindness. So, could not we sort of foresee that, in these 
cases, the hospital is going to say no and the institutional review 
board is going to say no, and the information will not be available 
for the research purposes because they face the potential of a 
lawsuit? 

Mr. LiBASSi. It is possible that some institutions may choose not 
to disclose on the grounds that it is a questionable practice and 
they wish not to get involved in it. 

But, by and large, institutions are now cooperating in making 
information available. They would have the security of knowing 
that the procedures are clearly spelled out by statute. If they have 
complied with those procedures, they would be protected. 

Actually, the individual would have the right of suit in the 
research situation against the research agency for misuse of its 
data. But, if it were a legitimate research project and the hospital 
complied with the requirements of the law, the hospital would not 
be liable. So, I think the hospital in a way has the confidence of 
knowing that, where a research application comes in, there is a law 
which sets a standard. Then they can feel free to go ahead and 
make disclosure. Some may choose not to. 

Mr. Kindness. In fact, under the current drafting of the proposed 
legislation, I guess a civil action would not lie unless and until a 



207 

person had been convicted under section 301 of the misdemeanor 
section; would it? 

Mr. LiBASSi. No. A private civil action could be brought even 
though no criminal action had been initiated. 

Mr. Kindness. It could be brought against the medical care 
facility or the institutional review board or governmental agency. 

Mr. LiBASSi. That is right — or the researcher, or research organi- 
zation, could also be sued. If they either improperly secured the 
information, or redisclosed it improperly, then the research organi- 
zation would be subject to suit; but not the hospital for originally 
having made it available to the researcher. 

Mr. Kindness. The research agency would only be subject to civil 
action for the commission of acts which constitute a crime under 
section 301, that is obtaining the information under false pretenses. 

Mr. LiBASSi. I would hope they would be subject to a civil action 
for more than that. 

Mr. Kindness. Or violation by a researcher of any provision of 
section 105(b)(5). I see. 

Mr. LiBASSi. That's it. 

Mr. Kindness. Thank you. 

Thank you, Mr. Chairman. 

Mr. Preyer. Thank you. 

We have one other witness today. There are some further ques- 
tions which we will want to put to you. If we do not get the 
information on these other questions in the record later on, we 
may ask you to submit answers in writing to these. I am thinking 
in terms of the costs that will be incurred as a result of medical 
records legislation, on whom you think the costs will fall, whether 
it is on the record users or whether it is on the recordkeepers. I 
believe Mr. Geller mentioned that startup costs are the only thing 
you anticipate. So, we may want to know a little further about 
that. Also, there is the question which was discussed with him a 
little earlier about the necessity of new types of recordkeeping 
controls on the part of hospitals. 

We will be going into those later on, I think. It may be we will 
want to call you back to get further information on that. 

I do have one final question I would like to ask Mr. Geller. 

This subcommittee has jurisdiction over the U.S. Postal Service, 
the FCC, Department of Justice, and Government information 
policy. There is a current dispute going on between the Postal 
Service and the FCC about jurisdiction over and the development 
of electronic mail systems. 

Could you briefly tell us whether the administration is develop- 
ing a position in this area and whether it involves a decision that 
this subcommittee and Congress should ultimately make? 

Mr. Geller. Yes, sir. There is a dispute in the area, as you 
mentioned. The administration is developing its position to what is 
called a Presidential response memorandum. All the agencies that 
are involved, including the U.S. Postal Service, have come together 
to thrash out the issues and to present them to the President for a 
decision. 

We believe very strongly that that decision is one for this Con- 
gress. It should not be made by the USPS or by the Postal Rate 



208 

Commission. They can only look at it from the viewpoint of the 
Postal Service. 

It should not be made by the FCC. They can only make it from 
the point of view of the private sector. It deals with telecommuni- 
cations only in the private sector. 

The only entity that can look at it overall and look at this issue 
from what is best for the Nation taking into account both the 
Postal Service and the overall telecommunications including the 
private sector is the Congress. 

Therefore, when we have worked out the administration's posi- 
tion, we believe it ought to be presented to the Congress. It is the 
Congress which should decide this issue. This would serve the 
Postal Service well also. They would then know how to plan. The 
private sector would be served by it; it would know what the 
ground rules are. 

But it is for the Congress, we think, to lay down the ground rules 
here. 

Mr. Preyer. Thank you very much, Mr. Geller. 

I want to thank all of you for the obvious thought and hard work 
that has gone into your recommendations. We will certainly look 
forward to working with you in the future on this. I hope we can 
develop some very helpful legislation in this area. 

Mr. Geller. Thank you. 

Mr. LiBASSL We look forward to it. 

Mr. Preyer. We will excuse you at this time. 

[Mr. Libassi's prepared statement follows:] 



209 



FOR RELEASE UPON DELIVERY 




DEPARTMENT OF HEALTH. EDUCATION. AND WELFARE 



STATEMENT 

BY 

F. PETER LIBASSI 
GENERAL COUNSEL 

BEFORE THE 

SUBCOMMITTEE ON GOVERNMENT INFORMATION 
AND INDIVIDUAL RIGHTS 
CGMMTTTEE ON GOVERNMENT OPERATIONS 
UNITED STATES HOUSE OF REPRESENTATIVES 



WEDNESDAY, APRIL 4, 1979 



210 



I am happy to be here to discuss with the Subcommittee proposals for 
legislation to protect the confidentiality of medical records. In 
addition to your own bill, H,R. 2979, you now have before you the 
Administration proposal in this area. My statement will highlight 
scane key features of our proposal. We look forward to working with 
you closely on these proposals. 

The bill is based in large part on the recommendations of the Privacy 
Protection Study Commission, established by Congress to study infoimation 
systems, in the health-care and other areas. In its charge to the 
Commission, the Congress directed it to advise on steps necessary "to 
protect the privacy of individuals while meeting the legitimate needs 
of government and society for information" (sec. 5(b), P.L. 95-579). 

The concern of the Congress that motivated the establishment of the 
Commission was based on the dramatic changes in record-keeping and its 
relationship to privacy that have occurred in recent years. The Com- 
mision's inquiry noted these changes, and their consequences, with 
special force in the case of health care records. 

The information in medical records is of special sensitivity, and 
requires special protection against disclosure. To get effective 
medical care a person must reveal sensitive, often intimate, personal 
matters, so that physicians and other health professionals have valid 
information on which to make diagnostic and therapeutic decisions. As 



211 



we "increase our awareness of the effects of our environment and personal 
lifestyle choices on health, health records may contain even more private 
information such as food and alcohol intake, sexual activity, recreational 
pursuits, travel and past residences. Developments in genetics have also 
encouraged the collection of information on the health status and 
environmental history of relatives. 

Medical developments that have increased the volume, complexity, and 
sensitivity of the record have been paralleled by social and techno- 
logical developments that weaken the traditional protections for the 
confidentiality of the record. Physicians and other health professionals 
have always had and observed ethical prescriptions about their patients' 
confidences; and certain State legal protections, like physician-patient 
privilege and other statutory barriers to disclosure, have also been an 
element of the protection. 

In the past, the principal controls were informal ones; the health care 
system was such that the traditional ethical and legal protections were 
effective. Today, these controls are not sufficient. Most of our health 
care is not obtained from physicians. Large, impersonal institutions 
provide care. The record is needed by many persons and institutions 
far from the physical, administrative, and ethical controls of physicians. 
Third-party payers, researchers, law-enforcement officials and others 
need medical record infoimation in connection with transactions involving 
the patient, as well as for uses not explicitly involving the patient. 
In addition, more information is maintained by computerized systems; this 



212 



presents special problems o£ security and unauthorized disclosure and 
use. It also encourages the centralization o£ records, with the benefits 
and hazards inherent in such centralization. 

Our proposal offers a Federal baseline of essential protections that 
all our citizens ought to have with respect to their records. Patients 
go from State to State, receiving care in many places. Information is 
transferred, with or without the patient's consent, from one State to 
another. The maintenance, use, and disclosure of medical information 
has become a national business. It requires the comprehensive, systematic 
approach that can be provided by Federal legislation. 

Brief Description of Our Proposal 

Our bill has two basic purposes: (1) to establish fair information 
practices for the holders of medical records, and (2) to place limits 
on government access to private medical information. Title I of the 
bill addresses the first purpose by establishing requirements for patient 
access to and correction of medical records and by restricting the types 
of disclosures that may be made of a patient's medical record without 
his approval. This title would would apply to all inpatient facilities 
and the Secretary could by regulation in^ose the rules on outpatient 
facilities receiving Federal grant funds. Title II of the bill would 
impose obligations on government authorities, both Federal and State, 
in obtaining information about patients from any health care providers , 
whether or not those providers are subject to the obligations relating 
to patient access, disclosure, and consent. Government agencies could 



213 



obtain information only in circumstances, and under conditions, set 
out in the bill. 

Health care providers would have no obligations under title II. The 
government agency would have to fulfil the requirements in seeking 
information from any health care provider, including physicians in 
private practice. With this background I will describe the provisions 
of the bill in more detail. 

Title I 

Title I prescribes how medical care facilities must treat written 
information viiich they maintain about their patients. It would cover 
all hospitals and nursing hones - in short, inpatient facilities. It would 
also cover, to the extent provided by the Secretary of HEW in regulations, 
outpatient facilities which receive grant funds under the Public Health 
Service Act, the Community Mental Health Centers Act, the Maternal and 
Child Health program under title V of the Social Security Act, the 
Comprehensive Alcoholism Prevention, Treatment and Rehabilitation Act 
of 1970, or the Drug Abuse Office and Treatment Act of 1972. 

This title would cover also Federal medical care institutions, and the 
Privacy Act would be amended so that the disclosure and patient access 
provisions of this Act would replace those of the Privacy Act for 
Federal hospitals. Federal institutions would still have to comply with 
such Privacy Act requirements as the publication of a system notice; and 
the Act's criminal penalties would apply as they have in the past. The 



214 



result would be that the rules for disclosure and for patient access 
would be the same for all hospitals, simplifying all dealing with 
hospitals. Hospitals operated by State and local governments which 
do not receive Federal funds would not be covered. 

Patient Access 

Under the bill, patients would be able to see their records, or designate 
others to do so for them, and obtain copies of materials in the records. 
An institution would have twenty days to provide this access, affording 
it flexibility, for example, to grant access only on certain days of 
the week, or to give a physician who has contributed to the record a 
chance to review it. 

There is a provision for the facility to channel the record through a 
third-party, of the individual's choice, where the facility determines 
that direct access would be haimful to the patient or to another person. 

In general we support the view of the Commission, and many observers of 
the health care scene, that patients should be able to see their own 
records. Such a right is essential for an individual to make intelligent 
choices about whether to authorize certain disclosures. It is already 
established by statute in ten States in approximately the form we propose, 
and fifteen more States provide access in limited ways, or with restric- 
tions. At the same time, there may be instances in which prudent medical 
judgment concludes that direct access by the patient would be harmful, 
and in such cases the draft bill provides for channeling the record 
through a third-party. 



215 



Correction 

A patient would be permitted under the bill to seek correction of a 
record. Under the proposal, if the facility declines to change the 
record, the patient may file a concise statement setting forth the 
patient's view. The hospital would have ninety days to make a decision 
about correction, thus pennitting consultation, if the hospital wishes, 
with those who have made entries in the record. 

The patient's right of access to and correction of information does not 
extend to materials assembled in reasonable anticipation of civil liti- 
gation. This provision is similar to one in the Privacy Act, and is 
designed to keep the patient access provision from serving as a covert 
discovery mechanism. 

Disclosure Limitations and Exceptions 

The expectation of confidentiality that that the patient is entitled to 
is established by sections 104 and 105 of the bill. Disclosure of 
information about a patient is prohibited unless the patient consents 
or unless the disclosure falls within one of the authorized disclosures 
spelled out in sec. 105 and the institution complies with the condi- 
tions for such disclosures. 

The disclosures permitted without consent fall into four general 
categories : 

(1) Disclosure in the normal operation of the institution, or 
needed for the patients' care, or for other health or safety 
purposes . 



216 



(2) Disclosures in which the specific identity o£ the patient may 
be needed, but is incidental to the use, and in which the 
individual will not normally be affected. Research, audit, 
and certain uses for payment programs fall into this category. 

(3) Disclosures which may affect the individual, but where it would 
thwart the purpose of the disclosure to seek consent. Some of 
these disclosures have specific procedural safeguards. 

(4) Disclosures within the Federal Government, vAere consent require- 
ments would thwart important government objectives (as in the 
case of members of the uniformed services in Federal hospitals) , 
or are already covered under other statutes (as in the case of 
Veterans Administration use of health records to determine 
claims) and obtaining consent would be merely formalistic in 
any case. 

We have given a great deal of thought to the framing of the non- consent 
disclosures and the conditions surrounding them. 

The Commission noted the sharp clash between society's interest in 
protecting medical confidentiality, and its interest in the wide variety 
of other important functions for which medical records are needed. The 
clash is not easy to resolve, or even mitigate. However, the confi- 
dentiality of the medical care relationship has been seriously eroded, 
and needs to be restored. 



217 



The solution, in the Ccmmission's view, is not simply to block third- 
party access. Individual uses have to be evaluated, and societal 
judgments made about "their appropriateness. The bill is an attempt to 
do that. 

We have observations on some of these particular uses. 

Patients' Relatives 

We have included an exception for disclosures to next of kin, and 
others close to the patient, consistent with accepted medical practice, 
to accommodate anergency situations where, for example, a close relative 
or friend inquires about an unconscious patient and it is appropriate to 
reveal details of the patient's condition. More specificity about such 
disclosures is not workable, and we would prefer to rely on medical 
personnel in the operational situation to make the choices and judgments 
necessary to maintain confidentiality and at the same time respect the 
emotional needs of the patient and those close to the patient. 

Research Disclosures 

The disclosures permitted for research and statistical purposes would be 
siibject to conditions set out in the bill. Once a researcher obtains 
the information, the conditions governing its use parallel those in the 
separate research confidentiality bill that is part of the Administration's 
privacy initiative. 

Much health research depends on access to identifiable records in situ- 
ations where patient consent cannot be feasibly obtained, or where to 



218 



permit patients to grant or withhold consent would bias the results. 
Examination of a medical record, followed by efforts to locate the 
individual or other records about him, in order to determine his health 
status, is a principal tool in studying the course of a disease in the 
population. This is done, for example, to study the coufse of illness 
over a long period of time, particularly in conditions which are not of 
ccanmon occurrence in the population at a single point in time, but which 
take a heavy toll over a long period, e.g., cancer. In all of these 
activities, access to medical records is a necessary first step in identi- 
fying patients so that they can be contacted, and, if they consent, be 
interviewed and studied, or so that subsequent records, such as death 
records, can be examined. This approach is vital in epidemiologic 
studies, in clinical studies of the natural history and prognosis of 
disease, in the evaluation of new modalities for the early detection and 
treatment of disease and in identifying factors associated with increased 
risk of disease. 

Our bill would require the facility to make certain explicit determinations 
before disclosing information for a research purpose. Facilities would be 
permitted (but not required) to rely on an Institutional Review Board 
(IRB) to make or review these determinations, which require scientific 
expertise. There is no obligation to use the IRB, but an institution 
which relies on one is freed from civil liability for its determination 
that that disclosure for research is appropriate. A disclosing institu- 
tion need not use its own IRB. It may not have one, and in such cases 
it may want to rely on the determination of the IRB at the institution 
sponsoring the research. 



219 



Aiidit Disclosures for Health Program Purposes 

Government audits, investigations, and evaluations are directed primarily 
toward facilities or health care practitioners, and the bill would 
permit disclosures for these activities. Related to this are disclosures 
to Federal or State authorities, and health insurance plans, for the 
purpose of determining the cost of care in the facility. 

Among the disclosures now customary or permitted or required by law are 
disclosures for routine audit, other detection efforts, investigations, 
and civil, administrative and criminal enforcement actions. Other 
important areas are audits and evaluation of program performance, and 
of medical care. The Food and Drug Administration also needs access to 
records for regulatory compliance and public health protection purposes. 
There is a serious problem of fraud, abuse, and waste in publicly funded 
medical programs. The control of such fraud and abuse requires a com- 
mitment to detect, investigate, and prosecute (civilly, adminstratively, 
and criminally) those who engage in fraud or abuse. This, in turn, 
requires that auditors, investigators, and prosecutors be given access 
to medical records. 

In such disclosures to non- governmental institutions or agencies the 
facility must, under sec. 104, assure that only as much information is 
disclosed as is needed to accomplish the purpose of the disclosure. In 
the case of official government audits and inquiries, the government 
agency is responsible for this limitation, since it would thwart the 
purpose of such an audit or inquiry to require or even permit the faci- 
lity to control, limit, or screen the records necessary to the inquiry. 



56-421 0-80 — 15 



220 



when the facility is typically the target or potential target of the 
investigation. 

Mandatory Reporting 

The draft bill would permit facilities to comply with requirements for 
reports to health departments of conditions of public health interest, 
and requirements for reports to law enforcement authorities. In the 
latter instance, the facility could make. whatever report is required by 
law; if a law enforcement authority then wanted more information from 
the record it would be required to follow the requirements in title II. 

Other Government Disclosures 

The Secret Service and Federal intelligence authorities could be provided 
with information for the specialized needs of those authorities, pursuant 
to formal request. 

Internal Federal Uses 

There are some exceptions to accommodate existing disclosures within 
the Federal Government. Uniformed services and penal and correctional 
authorities may have access to material relating to individuals under 
their control. In the uniformed services this exception does not extend 
to dependents; their records can only be disclosed pursuant to an authori- 
zation or one of the other exceptions. The Veterans Administration may 
use information from its medical care facilities for claims purposes, 
and may also obtain information from the uniformed services to assist 
in determining benefits. 



221 



Disclosure may be made to the Department of Justice, as an agent of a 
facility, in litigation relating to medical care, in the same way a non- 
Federal facility may provide the record to its attorneys. 

Disclosure Pursuant to Process 

Infomiation may be disclosed without any notice or other procedure^ 
pursuant to compulsory process in litigation or an ecpiivalent directive 
in an administrative action when a Government agency and an individual 
are parties. , 

Information may be disclosed in private litigation in accordance with 
existing law. 

For other disclosures to Government authorities, pursioant to administrative 
summons or subpoena, search warrant, judicial subpoena, or formal written 
request, the health care facility must receive a certification in writing 
that the Government authority has complied with the applicable require- 
ments of title II of the Act. 

Notification of Patients 

Facilities woiHd have to prepare a notice to let their patients know 
what disclosures may be made of information about them without their 
authorization. It must provide the notice to patients v^en first pro- 
viding care to them, and aisolnake the^otice available iipon request. " 
This is an important feature of the protection, largely because it 
educates patients with respect to the use of information and permits 
them to take steps to affect uses which they may disapprove of. 



222 



Authorization by Patiaits 

The bill establishes standards for the content of patient authorization 
for disclosure. They must be in writing, signed, and dated. The facility 
that is to do the disclosing and the intended recipient of the record must 
be named specifically or by generic category. We have allowed generic 
categorizations to accommodate such sitiiations as application ^or dis- 
ability benefits, where the applicant may not remember all facilities in 
which he was treated. Likewise, a facility may wish to disclose seme 
elements of a patient's record to a series of potential third-party payors; 
the patient raay^not know exactly vrtiat insurance plan or government program 
covers his care, but can authorize the facility to disclose a limited 
amount of information to identify such a funding source. 

We have not included the requirement, recommended by the Conmission, that 
the authorization include the prupose for the disclosure. The scheme of 
the Administration's Privacy Initiative does not envision that recipients 
of information will be legally bound by conditions in an authorization. 
At the same time, patients may not wish their health care facilities to 
know vrtiy they are asking that information be disclosed. Since there is 
a potential hazard to privacy in requiring this detail, and there is no 
sanction for improper use even if a purpose is stated, we concluded not 
to require a stated purpose. 

Title II 

Let me move on to the requirements of title II of the bill. As I indi- 
cated earlier, this title spells out the circumstances under which 



223 



State and Federal authorities may obtain information from health records 
held by any health care provider, whether or not the provider is required 
to observe the requirements in title I. Title II is meant to protect 
the records of individuals served by anyone who provides health services, 
including, but not limited to physicians, dentists, nurses, optometrists, 
physical therapists, occupational therapists, psychiatric social workers, 
clinical dietitians and clinical psychologists, as well as institutions 
or agencies providing any health service. This title does not impose 
new direct obligations for the confidentiality of patient records on 
these providers; its obligations are on Government authorities who seek 
records . 

Government authorities may generally obtain information under the same 
circumstances under which health care facilties may disclose information 
under the provisions of title^I^ Thus, information for research, audit, 
evaluation, medical emergencies, care of the patient, payment of claims 
and similar uses may be sought and received by government authorities 
to the extent necessary to accomplish the purpose for which the disclosure 
is to be made. The conditions surrounding such access are similar to 
those governing disclosure in title I. For example, a government agency 
receiving information for research must give all the assurances and is 
bound by the same restrictions on re -use that a private researcher 
would be bound by. 

Attempts by government agencies to obtain information by summons, subpoena, 
search warrants, and formal written request, under circumstances not 



224 



otherwise permitted by the bill, would be subject to a ntmiber of 
procedural protections to assure that, where at all possible, the 
individual whose record is sought has an opportunity to be heard. If 
a Federal or State authority seeks medical information under an admin- 
istrative summons or subpoena, a judicial subpoena, or a formal written 
request, and if a medical care facility in the circumstances would have 
no basis under the bill for disclosing the information, there would have 
to be reason to believe the records sought were relevant to a legitimate 
law enforcement inquiry. The authority would have to notify the individual 
in advance that it wanted medical information concerning him. The form 
of the notice is prescribed in the bill. 

The notice would be served on the individual or mailed to his last known 
address. The authority would have to wait 10 days from service of the 
notice or 14 days from mailing, to give the individual an opportunity to 
challenge the summons, subpoena, or request in court. 

The advance notice requiranent could be set aside by court order if there 
were reason to believe that notice would result in danger to anyone's 
physical safety, flight from prosecution, destruction of evidence, intimi- 
dation of witnesses, or would otherwise serious jeopardize an investi- 
gation or proceeding. Delays of up to 90 days could be granted, and 
further delays could be granted on the same showing of necessity. After 
the delay expired the individual would have to be notified that the 
iiifoTTnation had been obtained, and of the basis for the delay. 



225 



Challenge Procedures 

An individual who was notified o£ a Federal or State agency's intent to' 
obtain medical information concerning him could file a motion to prevent 
the disclosure. The individual would file a sworn statement that he was 
the person about whom information was sought and would state his reasons 
for believing that the information was not relevant to the investigation, 
or that the Government authority had not substantially complied 
vdth the requirements under the draft bill. If the court found that 
there was a reasonable belief that the infoimation was relevant, and 
that there had been substantial compliance with the draft bill, the 
information could be disclosed. Otherwise it could not be disclosed. 

I want to make clear that these notice and challenge provisions would 
not apply in those cases where government authorities could obtain access 
to records without formal process. Thus, an agency conducting a public 
health investigation, a financial audit, or a program or research audit 
or investigation could obtain information under the specific provisions 
in the bill permitting access for these purposes. In such a case, even 
if the provider refuses the request for access and forces the government 
agency to use a subpoena or warrant, the agency would not be obliged to 
provide the notice to the individual required by the provisions governing 
subpoenas and warrants, so long as the purpose of the access is covered 
by one of the exceptions provided for government access under title II. 

Agencies which have such authority are normally directing their inquiry 
at the facility, or are gathering information for public health purposes. 



226 



as in the case o£ the Food and Drug Administration and the National 
Institute of Occupational Safety and Health. To require notice and an 
opportunity for challenge in such cases would be to require a prohibitive 
administrative task, and would serve no purpose of the individuals, who 
are not being investigated. 

Emergency Situations 

In some situations, advance notice would cause serious harm, and the 
delay to get a court order would be intolerable. Thus, the bill allows 
Federal or State authorities tofobtamjnedical information upon request 

without advanced notice if the information is immediately needed to 
prevent inminent danger of serious propoerty damage, or of flight to 
avoid prosecution. The individual would be notified of such access as 
soon as practicable, but notice could be delayed on the same grounds 
and under the same procedure applicable to delay of advance notice for 
summons, subpoena, or formal request. The Government authority would 
also have to file with the appropriate court within five days a signed, 
sworn statement setting forth the grounds for the emergency access. 

This provision does not apply to emergency disclosures for personal 
health and safety. They are allowed by another provision of the bill, 
and must be noted in the patient's records. 

Search Warrants 

Federal or State authorities that obtain medical information by means 
of search warrants would have to notify the individual within 90 days, 
unless a court granted a delay on the same grounds and under the same 



227 



procedure applicable to delay of advance notice, or unless a medical care 
facility in the circumstances would have another basis under the draft 
bill for disclosing the information. 

Grand Jury Subpoenas 

Medical information obtained pursuant to a grand jury subpoena would have 
to be presented to the grand jury, and destroyed or returned to the health 
care provider if not used for grand jury or related purposes. 

Further Disclosure 

There are restrictions on further disclosure of information obtained 
under a summons, subpoena, search warrant, or formal written request, or 
in emergency situations. A Government authority that received information 
this way could transfer the information to another government authority 
only if it received a certification that there was reason to believe the 
information was relevant to a legitimate law enforcement inquiry within 
the jurisdiction of the receiving authority. The transferring authority 
would have to notify the individual that the transfer was made. The 
notice could be delayed if the transferring agency had already obtained 
a court order for such delay, or if the receiving authority obtained such 
an order, on the same ground and under the same procedure applicable to 
delay of advance notice. 

Other Aspects of the Bill 

Let me discuss now the penalties for violations of the provisions of the 

proposed statute. 



228 



Individuals harmed by a violation by a facility, a government agency, or 
a researcher of their obligations under any portion of the bill, or by 
a person who obtained information under false pretenses, could bring suit 
in a U.S. District Court or other court of competent jurisdiction, and 
could obtain actual damages, up to $10,000 in general damages, reasonable 
attorney's fees, as well as equitable and declaratory relief. In the 
case of State agencies, States which waived sovereign immunity could be 
"sued; in_States vdiich did not, suit could be brought against individual 
State officials. 

In addition to this principal enforcement mechanism of private civil 
suits, Federal funds could be denied to facilities which failed to provide 
assurances of substantial compliance with their obligations under title I. 
This would include the revocation of certification under Nfedicare and 
Medicaid, and the cut-off of funds under direct grant programs. 

There would be criminal penalties for requesting or obtaining information 
under false pretenses from any health care provider. 

Other Safeguards and Rights 

Federal authorities which obtain information for certain emergency 
purposes, or for intelligence or Secret Service protective functions, 
must compile an annual tabulation of these occasions. 

Federal authorities would be required to pay health care providers to 
search for and copy records obtained under a summons, subpoena, or 
search warrant, or for certain emergency situations, or for intelligence 
or protective functions, or pursuant to patient authorization. 



229 



Childrens Records 

Our proposal does not deal directly with the difficult issue of childrens 
records. The bill would authorize the Secretary to prescribe by regulat^ion 
the situations in which it would be in the interest of an individual under 
18 years of age to exercise his own rights. We have no definitive answer 
noiv on how this might be handled. Ideally, parents will be involved in 
their children's health care, but we are also strongly conniitted to the 
goal of permitting young people to have responsibility for their own care, 
expecially when a requirement for parental involvement would cause them 
to delay or omit treatment. Virtually all States permit minors to consent 
to their own treatment for certain conditions. The handling of records 
should be such that it does not thwart the purposes of those State 
statutes. Thus, it may be appropriate to have a rule that would permit 
adolescents to control their own records. However, it is difficult to 
write a rule applicable in all cases. Young people differ greatly in 
maturity, judgment, and their ability to manage their own affairs. We 
have begun to look at possible approaches. 

One approach would be to permit parents to exercise rights on behalf of 
their children except when the child has consented on his own to treatment, 
as allowed by State law. This presents certain practical problems, since 
a single record is hard to divide on the basis of who consented to the 
treatment. We look forward to hearing the views of professionals know- 
ledgeable about this, and to discussing it further. 



230 



Relationship to Other Laws 

Let me discuss briefly the relationship of the proposed statute to 
existing statutes governing confidentiality, patientaccess to ~ 
records, and the availability of records for disclspure. All existing 
statutes, Federal and State, which are not inconsistent with the proposal 
would remain in force. Thus, if State laws forbid disclosures which our 
proposal would peimit, those disclosures could not be made. The statutes 
governing the confidentiality of drug and alcohol abuse patient informa- 
tion (sec. 408 of the Drug Abuse Office and Treatment Act of 1972, and 
sec. 333 of the Comprehensive Alcohol Abuse and Alcoholism Prevention, 
Treatment, and Rehabilitation Act) provide more stringent protections for 
this especially sensitive class of records than our proposal does, and 
those more stringent protections would have to be observed. On the other 
hand, the drug and alcohol confidentiality statutes do not provide 
patients with a right of access to their own records; such a right would 
be granted in accordance with the proposal we are presenting. 

There is another point that should be made with respect to the disclosures 
permitted by the bill we recommend. No disclosures to third parties are 
required by it. The facility would not be obliged by this bill to make 
any of the disclosures permitted by Sec. 105(b). There are other statues 
which require disclosures, and if this bill permits those disclosures, 
they must be made, pursuant to those other statutes. For example, it is 
a condition of Medicare and Medicaid participation that the facility allow 
its records be reviewed for cost determinations, and the Comptroller 
General and the Inspector General of HEW have authority generally to 



231 



inspect records of facilities receiving Federal funds. Likewise, 
State laws require that facilities be audited, and that certain facts, 
like ccraraunicable diseases, be reported to health authorities. Certain 
public health authorities can compel disclosure of information by 
formal process. Our proposal is designed so as not to interfere with 
these disclosures on vrtiich there have been legislative decisions to 
require disclosure, but it does not of itself require any such disclosure. 

Concluding Remarks 

We have designed this proposal with care to avoid unnecessary record- 
keeping, notifications, and other paperwork. Likewise, we have avoided 
prescribing management mechanisms, such as appeal procedures within 
institutions. Medical care facilities can to the greatest extent possible 
build on their existing procedures; the bill we suggest would offer a 
uniform, national set of substantive rules on patient access, and 
disclosure standards, with a minimum of additional effort. 

The protection of the privacy of individuals with respect to medical 
information cannot depend solely on one statute, or even a set of 
statutes. Careful management, a strong ethical sense on the part of 
practitioners, thoughful policy consideration when establishing data 
systems, are all necessary, and they cannot effectively be compelled 
by law. The present legislative proposal is an attempt to provide the 
essential legislative base to support those efforts. 



232 

Mr. Preyer. Our last witness today is Dr. Alfred M. Freedman, 
who is chairman of the National Commission on Confidentiality of 
Health Records. He is accompanied by Mr. Robert Belair. 

We appreciate your being here today. We will admit your testi- 
mony into the record, without objection; and you may proceed in 
any manner you see fit, Dr. Freedman. 

STATEMENT OF ALFRED M. FREEDMAN, M.D., PRESIDENT AND 
CHAIRMAN, NATIONAL COMMISSION ON CONFIDENTIALITY 
OF HEALTH RECORDS; ACCOMPANIED BY ROBERT BELAIR, 
COUNSEL; AND TOBY LEVIN, ASSISTANT EXECUTIVE DIREC- 
TOR 

Dr. Freedman. Thank you, Mr. Chairman. 

I am Alfred M. Freedman, chairman of the National Commission 
on Confidentiality of Health Records and a past president of the 
American Psychiatric Association. To my right is Mr. Robert Bel- 
air, who is counsel to the National Commission on Confidentiality 
of Health Records; and on my left is Ms. Toby Levin, assistant 
executive director of the National Commission on Confidentiality of 
Health Records. 

I certainly feel privileged to be here this morning in my r'>le as 
president. I want to congratulate the chairman and the committee 
on its leadership in the privacy field and for being the first com- 
mittee to hold public hearings on perhaps the most critical of all 
privacy issues, confidentiality of health records. 

Let me say something about the history of our commission. It is 
a federation of some 24 national organizations whose purpose is the 
preservation and the promotion of confidentiality of health records. 
This has been a concern of ours for a long time. Actually, it owes 
its genesis to the Watergate years, when the American Psychiatric 
Association, of which I was then president, was shocked into taking 
concrete action on behalf of patient privacy. 

You remember the disgust of Senator Sam Ervin of North Caroli- 
na, when the Ellsberg-Fielding episode was brought before the 
Senate Watergate Committee, and those responsible for breaking 
into a private psychiatrist's office did not seem to know they had 
done anything wrong. 

This mobilized us into action. Agreeing with Senator Ervin, we 
convened a conference in 1974 at Key Biscayne, Fla. There some 50 
national medical and consumer organizations came together and on 
the basis of their decision, we launched a National Commission on 
Confidentiality of Health Records in 1976. We started with 17 
national groups ranging from the American Psychiatric Associ- 
ation, the American Academy of Pediatrics, to the Blue Cross, and 
the American Hospital Association. 

We have increased in numbers since that time to 24, including 
the National Congress of Parents and Teachers and the American 
Statistical Association. Our organization has established itself as a 
vigorous nonprofit group promoting a fair balance between the 
patient's right to privacy and society's legitimate needs for person- 
al health information— a conflict, of course, that all of you 
recognize. 

Through its informational and educational activities, including 
its National Clearinghouse publications and its comments on Fed- 



233 

eral and State legislative and regulatory proposals, the National 
Commission on Confidentiality of Health Records has sought to 
increase national awareness of health confidentiality problems and 
obligations. 

In the IVi years of our existence, we have been distressed by the 
continuing erosion of practitioner-patient confidentiality and the 
tremendous rise in the demands of third parties for health record 
information. 

Confidentiality is the key issue. In general, access to patients' 
records should be with patient consent. In this regard, we favor the 
Privacy Protection Study Commission's patient consent standard. 

However, we recognize that it is impossible in today's health 
world to keep health information totally within the private circle 
of the health care provider and the patient. Health care has en- 
tered the computer age and the increased demand by such third 
parties as insurers, government agencies, researchers and employ- 
ers for access to personal health data has created a virtual revolu- 
tion in health record keeping. 

We have concerns about those disclosures made without patient 
consent, particularly in the area of government access for anti- 
fraud, third-party payment, and law enforcement reasons. We have 
concerns, too, in the area of private business access by insurers, 
employers, and others. And we also have concerns in the area of 
researcher access. 

Unrestricted access by third parties, even for legitimate reasons, 
can cause serious problems for patients when medical information 
"gets around". It can lead to embarrassment, strained or broken 
relationships with family, friends and work associates, career and 
economic damage including loss of job or promotion, denial of 
insurance benefits, or refusal of admission to graduate school. 

These issues have been made very clear in a number of letters 
that we have received at the commission office. Let me illustrate. 

THIRD-PARTY PAYERS 

With regard to third-party payments, one must appreciate that 
nearly 70 percent of health care costs, including 94.1 percent of 
hospital expenses and 61.2 percent of physicians' bills, involve 
third-party payment. So there is great interest on the part of 
insurance carriers in patient records for underwriting and claims 
processing purposes. 

Patients and practitioners legitimately complain that insurers 
often ask for photocopied hospital records and highly detailed psy- 
chiatric reports that I personally can attest comprise more infor- 
mation than they really need. In addition, once information is 
collected by an insurance company or an investigative agency, it is 
widely traded within the entire industry through such groups as 
the Medical Information Bureau which holds information on some 
11 million people. 

Another issue is raised when health care is paid for through a 
group insurance plan, and medical data often ends up in the hands 
of the patient's employer. As a result— and I would like to empha- 
size this point particularly because it is one that is not often 
appreciated — many individuals will not use their psychiatric cover- 



234 

age for fear of repercussions at work. They feel it may endanger 
their job or their future career development. Others are mystified 
when applications for life, health, or disability insurance are inex- 
plicably rejected. 

Two examples from the National Commission on Confidentiality 
of Health Records' correspondence illustrate some of these prob- 
lems. For example, in one case a woman who had applied for group 
insurance was notified that her coverage would be limited because 
she had high blood pressure. Although she immediately protested 
she had never had such a condition, the insurance company would 
not answer her letter to explain how it had obtained the false 
information. 

In another case, a young woman wrote that she was mistakenly 
diagnosed as an epileptic and was denied insurance based on this 
mistaken diagnosis. She wanted to know how such information was 
obtained and how to correct it so as not to be permanently uninsur- 
able. 

Once mistaken, incomplete, or distorted information enters the 
insurance data system, correcting it can be very difficult. When an 
application is rejected, the applicant rarely knows why or how to 
contest the decision. Patients often write us that they conceal 
previous treatments for medical and emotional problems rather 
than subject themselves to negative assessments of their insur- 
ability. 

A dramatic example of insurer abuse was related to us by a New 
York physician who refused to disclose information about one of 
his patients to an unidentified woman over the telephone. After 
several calls, she identified herself as an insurance investigator but 
still refused to say why she wanted the patient information. Ha- 
rassment escalated to the point where the physician said the inves- 
tigating agency "was going to open a file on me with the inference 
that my noncooperation will now be part of my credit record." 
Such practices run counter to the policies recommended by the 
Privacy Protection Study Commission and recently adopted by a 
number of insurance companies. 

GOVERNMENT ACCESS 

Government sources often make troubling demands for personal 
health information. If health care is financed through State or 
Federal Government funds, extremely complicated systems have 
usually been set up to prevent fraud and abuse and assure a 
reasonable standard of care in health care programing. Health and 
welfare officials, professional standards review organizations 
(PSRO's), hospital certification authorities, and fraud investigation 
units may all receive medical information or seek direct access to 
patient records. This vast store of information accumulating in 
government files disturbs many practitioners and patients. 

In many government agencies, circulating health information 
through multiple and often duplicating levels of reviews seems to 
receive a higher priority than safeguarding confidentiality. This 
seems unlikely to change as the Government's role in health care 
and health insurance expands. 



235 

Again, we have many letters in our files about Government 
demand for health information, probably more than about any 
other issue. Some have actually come from government officials 
themselves requesting assistance in resolving conflicts between re- 
viewing agencies and practitioners. 

A drug abuse clinic administrator wrote us that his clinic's rec- 
ords were reviewed by some 10 representatives from five separate 
government agencies in the course of a year. He felt strongly that 
this made a mockery of confidentiality. He also questioned the 
qualifications of reviewers who lacked professional training and 
who giggled while examining patient records. 

Another dimension of government access to medical information 
is the increased demand for compulsory reporting to public health 
authorities. A Florida community mental health center president 
strongly opposed a new Florida regulation requiring compulsory 
reporting of names, social security numbers, and addresses of all 
patients. After protests, the State's action was postponed to July 
1979. But, to our knowledge, the matter has not been resolved. 

In a similar vein, a New Jersey hospital administrator raised 
objections to the increasing demand by government agencies for 
personal and social data, usually for well-intentioned research stud- 
ies, but all too often through methods which expose the lives of 
private citizens, he was particularly concerned when the New 
Jersey Department of Health requested detailed information on 
abortions in a form that could easily lead to the identification of 
individual patients. He wrote, "All too often the government asks 
for information it does not really need in the pursuit of better 
public health." 

employees' health records 

The National Commission on Confidentiality of Health Records 
has devoted a great deal of attention this past year to the need for 
new standards for the use of employees' health records. Confiden- 
tiality assumes extreme importance in the occupational setting, 
where loss of a job or a promotion opportunity can bring dire 
economic and emotional consequences. 

Health information flows into the workplace through a number 
of channels, including job application forms, physicals taken by 
prospective employees, evaluation, and treatment provided by the 
corporation's medical department, and claims submitted by employ- 
ees enrolled in group health insurance plans. 

What's more, occupational health records providing clues to envi- 
ronmental causes of illness are sought by NIOSH and OSHA for 
detection of hazardous substances in the workplace. As a result of 
comment from public groups, and particularly from our National 
Commission, on OSHA's proposed medical records regulations 29 
CFR 1910.20, OSHA has developed confidentiality guidelines gov- 
erning its collection, use and disclosure of employee medical record 
information. 

But these employers' policies vary widely. Some corporations 
strictly insulate medical data from other records, while others still 
mix medical information with personnel records. Many employers 
still ask applicants whether they have ever received psychiatric 
treatments. Many employees fear that such medical information 



56-421 O - 80 — 16 



236 

provided to their employer will label them as a future financial 
risk to the company. 

In a recent local court case in which we were involved, a Mary- 
land social worker named Bonnie Cox Womeldorf successfully op- 
posed the medical information requirements of the Montgomery 
County Welfare Department. This has been written up in the news- 
paper extensively. The pre-employment questionnaire contained 
such questions as "Have you ever had vaginal discharge?" and "Do 
you fear heights?" 

They were questions quite irrelevant to the job she was seeking. 
She refused to give blanket consent to disclosure of her medical 
records. When she took steps to bring suit, the intrusive questions 
and blanket consent clause were removed in an out-of-court settle- 
ment, and the county made across-the-board changes in its han- 
dling of employee health records. 

I think this case is especially important because it illustrates 
that if people do oppose an inappropriate action or requirement, if 
they have the patience and necessary legal help — and this individu- 
al did also receive help from the National Association of Social 
Workers and the mental health law project — they can succeed. 

HEALTH RESEARCH AND HEALTH DATA BANKS 

In regard to health research and health data banks, these have 
presented some of the more difficult balances between patient pri- 
vacy and society's need to know. In general, research tends to 
receive special consideration when its information needs conflict 
with confidentiality. Some researchers have argued that research 
be given a privileged enclave status with relatively unrestricted 
access to medical records. 

One would have doubt with regard to such an enclave. But, if it 
is created, we must carefully define its members and place an 
absolute prohibition on disclosures of research data for nonre- 
search purposes. 

We must also assure that patient-identifying information is col- 
lected for a definite research purpose. When agencies collect infor- 
mation without adequate safeguards and without explaining why 
they need the information, it begins to appear as though as one of 
our correspondents put it, "the government is assuming a question- 
able big brother role." 

A disturbing example of unauthorized disclosure of health re- 
search information occurred when New York State Health Depart- 
ment researchers conducting an abortion study financed by the 
National Institutes of Health, disclosed the names of some 28 
women involved in a progress report to NIH. They even circulated 
partial names of women to the Department of Motor Vehicles to 
locate study subjects who had moved. 

CHILDREN AND YOUTH 

There are very special confidentiality problems where children 
and youth are concerned. These are too often neglected. Minors 
have real privacy interests that do not always coincide with the 
interests of their parents. It is also important to remember that 



237 

children have a long, unforeseeable future. Facts collected about 
the health of a 2-year-old may remain in his records for 70 years. 

The family physician's or school health record often contains 
tentative diagnoses, unproven guesses, and developmental data 
which in the years to come may acquire an unwarranted patina of 
objectivity. For example, a child labeled with "minimal brain dys- 
function"— or MBD— may have been experiencing slow motor de- 
velopment at age six; and this may have completely disappeared 
but remains in the record. 

Of course, confidentiality is not always in the interests of a 
minor patient — not, for instance, when parents take steps to pre- 
vent evidence of child abuse or neglect from reaching authorities. 
On the other hand, we must remember that adolescents have a 
strong interest in confidentiality when they visit a clinic for birth 
control counseling, treatment of venereal disease, or other confi- 
dential services that the law entitles them to receive without pa- 
rental consent. Letting parents know about such visits against the 
patient's wishes may interfere with the minor's right to privacy. 

Above all, practitioners must be encouraged to respect a minor 
patient's need for confidentiality as something separate and dis- 
tinct from the wishes of his parents. 

PATIENT PARTICIPATION RIGHTS 

As one of our patient correspondents said, "My health records 
are available for anyone's use or misuse except my own." The 
current patchwork of State laws— with some 13 States providing 
patients with access to their records in varying degrees— creates 
unnecessary confusion among the public. How can patients author- 
ize access to their records by third parties, if they themselves do 
not know what the records contain? 

When it is necessary to guard against the possibly harmful ef- 
fects of allowing certain psychiatric or terminally ill patients to see 
their records, special procedures can be arranged. For example, a 
health professional designated by the patient can decide how much 
of the record a patient should see. But the need for special proce- 
dures in special cases should not get in the way of providing access, 
as a general rule, for those patients who request it. 

Let me conclude. 

I would say unequivocally that there is a real need for Federal 
medical privacy legislation for the following reasons: 

First, we see only the tip of the iceberg in abuses of health 
records confidentiality. 

Second, most patient-consumers are not aware of the uses of 
personal health information until they experience some direct eco- 
nomic harm or emotional embarrassment. 

Third, the status of current State law is a polyglot of protections 
and access laws largely limited in coverage to State-run institu- 
tions. 

Finally, the Privacy Protection Study Commission has document- 
ed the medical privacy issues and has recommended Federal legis- 
lation. 

Any medical privacy legislation must address these broad ques- 
tions: 



238 

Who has access to confidential personal health information and 
for what purposes? 

What confidentiality safeguards are health recordkeepers expect- 
ed to have? 

What legal expectation of confidentiality is a patient entitled to 
and how will it be enforced? 

By way of summary, we at the National Commission on Confi- 
dentiality of Health Records welcome your efforts to meet the 
needs for comprehensive legislation in four respects: 

One, your bill, Mr. Preyer, provides patients with an explanation 
of providers' recordkeeping practices and patients' privacy rights. 

Two, it provides patients with right of access to their health 

records. -r- j 

Three, it makes patient consent standards more specific and 

detailed. 

Four, it restricts nonconsensual disclosure of health records. 

I want to thank the committee members for receiving my re- 
marks this morning. I hope that this has contributed to your 
efforts and that at a future time we will be asked to comment on 
specific legislation. 

I will be pleased to answer any questions that you may have. 

Mr. Preyer. Thank you very much, Dr. Freedman. We appreci- 
ate your testimony today. It has been very helpful. 

We will take advantage of your offer to contact you at a future 
time for comments on specific legislation. 

I regret that we are running a little late today. Some of the 
questions that we might like to ask you we will have to ask later. 

Let me ask you one question that is of concern to us. In the case 
of United States v. Miller, the Supreme Court held that an individ- 
ual had no interest in his bank records held by a bank if the 
records were subpenaed from the bank. 

Does that ruling apply, in your judgment, to medical records as 
well as bank records? 

Dr. Freedman. I would like to ask our counsel, Mr. Belair, who 
has been working on this particular issue, to comment on that. 

Mr. Belair. Our sense, Mr. Chairman, is that there is plenty of 
room for the court, if it wants to, to distinguish the bank records 
case from the medical records case. 

As you know, in the Miller decision, the court said that bank 
records were not confidential information, not the private papers of 
the bank customer. We are hopeful that, in the medical context, 
the court would see fit to rule that these papers are in fact confi- 
dential, the records are the private property of the patient. 

On the other hand, we are aware that in most States the law 
provides that hospital records are the property of the hospital. 

We are also not encouraged by the Supreme Court's treatment of 
the medical records issue in Whalen v. Roe. In this case the Court 
seemed to suggest that, although there may be some very abstract 
right of privacy in medical records, at least in that case involving 
New York State's access to very sensitive drug record information, 
it was not terribly concerned with the State's collection of this 
information from a constitutional standpoint. 

Therefore, it seems to us that your committee, sir, is very well 
founded in its concern that, in the absence of the Government 



239 

access safeguards that you have written into your legislation and 
that appear in the other two pieces of legislation, it might very 
well be that the court getting this question — and the Supreme 
Court, of course, has not spoken directly to this question as yet — 
might see United States v. Miller as a precedent. 

Mr. Preyer. Thank you, Mr. Belair. 

Mr. Kindness. 

Mr. Kindness. Thank you, Mr. Chairman. 

I have no questions at this point. 

I appreciate your testimony today, sir. 

Mr. Preyer. Mr. Weiss. 

Mr. Weiss. Thank you, Mr. Chairman. 

First I would like to add a word of welcome to Dr. Freedman, 
who has been not only a distinguished citizen but also a distin- 
guished constituent of mine and a good friend for many years. I 
think that he has made a very, very valuable contribution to our 
consideration of the subject. 

I guess I really have only one general area because I think the 
testimony really covers the subject very, very well. 

That is this. What has the Commission noted — what have you 
individually noted about the concern of individual physicians who 
may be caught in this kind of "never-never land" of having to 
balance the rights of patients as against the rights of the Govern- 
ment or demanding agencies or organizations? 

Dr. Freedman. Overall, a great concern. Probably no issue at the 
present time is of greater concern to physicians in general, particu- 
larly for my own specialty of psychiatry. 

Since the formation of the Commission, I have constantly been 
requested to address groups. They raise truly agonizing problems in 
this regard and also bring forth a number of problems — for exam- 
ple, the insurance forms. There is one I saw recently put out by an 
insurance company which asks such questions of the psychiatrist: 
Have you been trained in any psychoanalytic school? What psy- 
choanalytic school was that? Was a transference effected with your 
patient? Describe some of the patient's fantasy life. 

Questions of the nature of whether transference was effected 
were asked of the patient. I cannot see how this has anything to do 
with the reimbursement question. So, physicians are very troubled 
about that. Those in hospital practice are also perturbed about 
leakage of information or some of the loose handling of material in 
the hospital situation. 

Problems of access are perturbing particularly for the psychia- 
trist. I think the position here is one that certainly receives sup- 
port because, while patient access in most cases is no problem, 
psychiatrists do run into situations in which they feel it would be 
deleterious to the patient to see the record at a certain point in 
treatment — for example when in psychiatric practice, the physician 
or social worker interviews members of the family, gathering third- 
party information given in confidence. This may create enormous 
problems if the patient has access to all this material. 

So, I would say confidentiality is a big problem. It is a problem 
for other physicians, those involved with venereal disease or abor- 
tion or cancer reports. They all find themselves beset by so many 



240 

records. Then the whole area of third-party payments, of course, is 
a very big question. 

Mr. Weiss. I thank you very much. 

As I say, the testimony has been very, very comprehensive and I 
think very helpful. I am sure that we will be calling on you as the 
occasion warrants and as we proceed in this legislation. 

Thank you, Mr. Chairman. 

Mr. Preyer. Thank you, Mr. Weiss. 

Dr. Freedman, Mr. Belair, and Ms. Levin, we appreciate very 
much your being here today. While there are some other questions 
which we would like to get your wisdom on, I hope you will let us 
contact you about them a little later on, in view of the hour. 

Dr. Freedman. Thank you. 

Mr. Preyer. The subcommittee stands adjourned until Monday 
at 10 a.m. 

[Supplemental material submitted by Dr. Freedman follows:] 



241 



NATIONAL COMMISSION ON CONFIDENTIALITY OF HEALTH RECORDS 



606 National Press Building Washington, D.C. 20045 



(202U47-0900 



Eiecutive CommMM 

ALFRED M FREEDMAN MD 
".nSfdent and Chaitrrun 
ANN KAHN 

Vice Pnsideni and Vce Chait 
KAJM BRENT 

ELOISEM AGGER- HSW 

SacfMary 

JEROMES BEIGLER.MD 

HERBERT PARIS 

HERBERT SACKS MD 

Ful Memb«rs 

ArwIch AesMnr •* CliH PiycbMrf 

Difecior HERBERr SACKS. MO 
AnwicM AodMiT •) PMtilrict 
Direcror ADELED hOFMANN MD 



Dtrector HENRYA SEGAL MO 
AmrtcM Hmribl AtucMea 

Oiredot HERBERT PARIS 
AiMTlcM Mtdtcjt R«<rt AnsetniMi 
Director LORRAINE V0L2. RRA 



D'fKlor JOYCE K LABEN RN MS. JD 



n PfvchMilC A 

Di'ectQi ALFRED M FREEDMAN MO 



Director JEROME S BEtGLER MO 



Director FREDSTRASSBURGER, PhO 
Bbt Cmi AtMdMlM 

Duocior ANN SALADtNO 



Director LEON YOCHElSON MD 



Direclor ROBERTS LONG MD 
Hmw Han AtswtrtM 

Drrecior HARRY EBELING 
HrtMut Anaciattoii tf Prhnlt 
PtTCtllllhC HMpl«b 
Director WALTER M WELLBORN. MO 
NMMUi AnadMan af Sidil «vfe«t 
Dnecior SUANNAJ WILSON 
tWlMal Cn«nu il Pmtti tai TodM 
Du-BCtOf ANN KAHN 



D«ector ELOISEM AGGER MSW 

Auodita Mtmbars 

AiMhcM ActMai ■! Otcmpttmut MtdUw 
AnrlcM AcsdMT il rifClMIrr aid UM Us 
Onoclor ROBERT L SADOFf MD 
Aaaricaa 6twp PtircMkarapr AM«Mli« 

DuBCtof JOHN F BOHfllELlO PhD 
Anarteaa mttkM tttiKtf aa AfcitaliB 

Offector SHEILA BLUME MD 



Director BERNARD J SCHUMAN.HO 
Aavtcaa SWMcai AmwMM 
OffBClor JOSEPH L FLEISS 
HabaMl CMad t( Haalk Cm Sarrteat 

Direclor REYNOLD P FLOM MD 
niiMwtf rsrnilfeaad Fatfanflaa m Avanu 

Eucuttvi Dlrtctor 

NATALIE DAVIS SPINGARN 

RMsarth Director 

ALANF WESTIN.PttD.LLB 



^AY 2 81979 



May 25, 1979 



Honorable Richardson Prayer 
U.S. House of Representatives 
Washington, D.C. 20515 

Dear Congressman Prayer: 

In response to your request, I am pleased to submit 
answers to questions your staff has raised and a 
sampling of letters from our case file concerning the 
confidentiality of health records. 

Also included is a list of some of the more comprehen- 
sive state medical privacy statutes. We are now pre- 
paring a more detailed reference to state citations and 
will forward it to you when completed. 

Please let us know if we can be of further assistance. 
We look forward to working with you in obtaining 
appropriate and fair health privacy legislation. 




OjO 



Alfred M. Fraedman, M.D. 
President and Chairman 



AMF:dws 



Contributions to NCCHfl are detJucliQie tor income-la« purposes 



242 



MEMORANDUM 

TO: Representative Richardson Preyer 

Chairman, Government Information and 
Individual Rights Subcommittee 

FROM: National Commission on Confidentiality 
of Health Records Staff 

RE: Response to Subcommittee Questions 

Privacy Awareness 

The National Commission on Confidentiality of Health Records has received 
hundreds of letters over the past three years from patients, physicians, 
nurses, social workers, hospital administrators, attorneys, employers, 
unions, government officials, and insurers concerned about the confiden- 
tiality of health records. Generally, the largest proportion of letters 
raise issues regarding government access to health records for audit and 
quality-of-care review. The second largest group of letters raise privacy 
problems regarding third party payers. The remaining letters concern 
hospital and employer information practices, disclosure in court pro- 
ceedings, school records, and the need for new medical privacy legislation. 

While NCCHR has not made a systematic, empirical study, our correspond- 
ence and our impact on the media definitely support the conclusion that 
public awareness of health privacy has increased dramatically. After 
every news article identifying the Commission, we are deluged with mail 
from patients and providers describing health information abuses and 
showing concern for protection of confidentiality. A sample of our mail 
is attached. Shocked by the ease with which third parties have accessed 
their record information, some patients voice great skepticism about 
their privacy and the confidentiality of the doctor-patient relationship. 
Many also see the computer as a symbol of lost privacy and of "big 
brother" data banks. Our case file also includes a number of letters 
from patients who were denied access to their own records, and who feel 
frustrated, angry, and shocked that patient access is not a legal right 
in most states . 

Federal vs. State Action 

Federal health privacy legislation is sorely needed, as state law 
has not adequately protected the privacy rights of all U.S. citizens. 
Under a Ford Foundation research grant NCCHR conducted a one-year study 
of state and federal law affecting the management of health record 
information. We sought to gather those code provisions which authorize, 
require, or prohibit disclosure of patient record information held by 
a health care provider. We found that state health privacy law was an 
uneven patchwork of loosely worded confidentiality regulations. Few 
states had anything approaching comprehensive health privacy legislation. 



243 



and even those that did were generally limited protection to state-run 
facilities. Rhode Island, Illinois, and the District of Columbia have 
recently passed health privacy legislation (the latter two limited to 
mental health information) , but the state legislative trend is slow 
and uneven. Only about a third of the states provide for some form of 
patient access to their health records, and even in those states, 
patients may have to resort to litigation in order to gain access. 

Even if the performance of state legislatures in this area improved, 
no state law can restrict federal government access to records. See, 
for example. Securities and Exchange Commission v. First Tennessee Bank 
N.A. Memphis (W.D. Tenn. February 27, 1978). As federal access has 
raised some of the major privacy issues, leaving privacy to state legis- 
lation would fail to address a key aspect of the problem. 

Federal action is also required to deal with today' s interstate commerce 
in health information. The Multi-State Information System, for example, 
is a private computerized mental health data system handling data for 
facilities in six states, with headquarters in Orangeburg, New York. 
Insurers conduct their business nationwide, as do researchers, auditors, 
and even some health care providers, such as Kaiser Permanente. Today's 
patients move frequently; they can enjoy privacy rights in one state and 
lose them in another. 

Many states provide in general language that "patient records shall be 
confidential" as part of health facility licensing requirements, duties 
of state facilities, or patient rights statutes. But they do not 
specify authorized disclosures or establish penalties for violations. 
In fact, what they mean is not clear, and we do not know if these vague 
provisions are even enforced. 

NCCHR staff is now preparing a detailed inventory of state statutes 
affecting professional and institutional handling of patient health 
information. It will cite provisions covering public health reporting, 
health data registries, specialized treatment facilities such as alcohol 
and drug abuse centers, patient access, and recordkeeping and confiden- 
tiality requirements for licensing of health care facilities. 

Very few states have a comprehensive approach to health records 
confidentiality — an approach including standards for patient access, 
record maintenance and safeguards, limited nonconsensual disclosures, 
and penalty for violations. The following are examples of states with 
such comprehensive statutes: 

Rhode Island: 1978 R.I. Pub. Laws ch.297 

District of Columbia: 1978 D.C. Act 2-292 

Illinois: 1978 S.B.255 

Michigan: Michigan Compiled Law Annotated §330.1748 

New York (Nursing Homes): 1975 N.Y. Pub. Health (McKinney) S2805-e 



244 



Patient Confidence 

There can be no doubt that the confidentiality of health records enhances 
patient confidence in physicians and hospitals. This is particularly 
true for psychiatric patients, whose treatment depends on trust placed 
in a mental health professional. Our NCCHR case letter file includes 
letters from irate patients embarrassed or economically harmed by dis- 
closure of personal health information without their consent. These 
patients denounce the disclosure, the physicians, and the health care 
system for failing to provide the privacy protection to which they 
thought they were entitled. 

Breaches of confidentiality erode the health care relationship and 
can result in patients hopping from provider to provider searching for 
truly private care. Most patients today depend on public or private 
insurance to meet their medical expenses; in return they virtually 
sign away their health privacy without real assurance that their health 
information will be kept confidential. (See attached article on Medic- 
aid audits . ) 

Patient confidence also suffers when a patient is denied access to his 
records. If patient access was a universally recognized statutory 
right, available without litigation, patients would feel that their 
treatment was being conducted in the "sunshine," and would be able to 
monitor and evaluate their care. One possible result could be fewer 
malpractice suits and other costly litigation. 



Attachments 



245 



ST. VINCENT'S HOSPITAL 

AND MEDICAL CENTER OF NEW YORK 



July 20, 1976 



Director 



Alfred M. Freedman,. M.D. , 
National Commission on 
Confidentiality of Health Records 
1700 Eiyhteenth Street, N.W. , 
Washington, D.C. 20009 

Dear Dr. Freedman: 




153 WEST llih STREET 
NEW YORK. N Y 1001 1 
212-620-1234 



I recently read with great interest a newspaper account of 
your Commission's charge and work. You are to be commended 
for your efforts in this area. 

I am writing at this time to acquaint you with the local. 
State and Federal medical data reporting requirements 
pertaining to utilization review. Briefly, in order to 
ascertain and ensure the "appropriateness" and "medical 
necessity" of services provided at St. Vincent's Hospital, 

All Hospital charts - both inpatient and ambulatory 
care cases - are subject to photocopying requests 
from the various private insurance carriers. Often, 
the entire medical record is requisitioned and 
sent to the carier as a requirement for claims 
payment. 

Blue Cross requires the completion of a "Hospital 
Request for 'Continuation Benefits'" form at 
twenty-one day intervals for all their subscribers. 

Both Medicare and Medicaid require the submission 
of extensive medical data on the Hospital billing 
foirms (making them readily available and accessible 
to non-medical personnel both at the Hospital and 
at the Medicare and Medicaid offices) in addition 
to the previously referenced photocopy material. 
These data enable the development of medical profiles 
for both patients and providers 



246 



In partial fulfillment of the Medicare and Medicaid 
"Conditions of Participation," the Hospital sub- 
scribes to the Professional Activity Study - Medical 
Audit Program (PAS-MAP) of the Commission on 
Professional and Hospital Activities. CPHA requires 
the completion of an extensive abstract of each 
inpatient record. Once again, the goal is the 
development of patient/provider profiles. 

St. Vincent's Hospital has been awarded fully 
delegated review authority by the New York County 
Health Services Review Organization - the local 
Professional Standards Review Organization. 
NYCHSRO, too, requires the completion of an 
extensive discharge abstract for profile development. 

The New York State Department of Mental Hygiene 
requires completion of the MS-5 "Admission and 
Termination Form" for psychiatric inpatients and 
outpatients. 

In summary, both inpatient and outpatient records are subject 
to extensive scrutiny by all the various third parties and 
regulatory agencies. Increasingly, this is accomplished by 
means of machine readable chart abstracts which the Hospital 
must submit in order to be paid for services rendered. 

I sincerely hope the above synopsis will be of some value to 
the Commission's work. Please do not hesitate to contact me 
personally if I may be of any additional assistance. 



Sincerely yours, 

John Bittoni 
Department Head 
Utilization Review 

JBrtln 



247 



1««l • !•■« 







^<:; 



ASHEVILtC. H. C. 

aaaoa 

March 25, 1977 



MAIIK A. emrriN, Jn. M.B, 
liesKNT A. OMirriN, m.d. 



Mrs. Pearl Honeycutt, Analyst 

Benefit Review 

Benefits Administration 

Blue Cross/Blue Shield of North Carolina 

P. 0. Box 2291 

Durham, North Carolina 27702 

Dear Mrs. Honeycutt: 

Encl6sed-please-find"-niedical_records-which include- admission history-, progress.-=:— - 
"notes,- doctor's orders and -nursing jiotes; for -the hospitalization of Charles' 
, Identification -No. - ; Confinement beginning January , 19 

This set of records constitutes 115 pages of photo copies of the original record 
from date of admission to present (patient still hospitalized). 79 pages of the 
record are nurses' notes. 

I realize the necessity of the review of records to determine liability under 
the FEP program. However, I seriously question whether or not all of these 
records are needed. Even Medicare, although requesting copies of history, 
progress notes, doctor's orders and discharge summary on every Medicare admission, 
does not request copies of the nurses' notes. 

I also wonder when the various segments of the Federal Government will begin 
communicating with each other. As an arm of the Federal Government, you are 
requesting these 115 pages of medical records. It costs us between 3 and 4 cents 
per page for these Xerox copies, to say nothing of the time involved and the 
postage necessary to mail them. At the same time, the Executive bri;nch of the 
Government and the Department of Health, Education and Welfare is asking Congress 
to put a cap on hospital rate increases. Some way or other, the right hand ought 
to know what the left hand is doing. 

May I also speak to the subject of confidentiality. These records undoubtedly 
reveal the most intimate facts about the patient's life, as do all records from 
a psychiatric hospital. Even though they are marked "confidential" on every page, 
I literally cringe when I see records like these being mailed to FEP, Medicare and ' 
Champus. (I mention the^e three insurance programs specifically because it is 
very seldom that any commercial health insurer requests records.) 



248 



I wonder what happens to these records? Who reads them? Where are they placed 
after review? Who else might have access to them? Would you like all the 
intimate matters In your life exposed to who knows who or what? 

This hospital has a Utillzatiori Review Committee with two psychiatrists, who 

are not on our medical staff, serving as the physician members of the committee. 

All Medicare, FEP and Champus records are reviewed by this committee and each 

patient with these insurance coverages has a treatment plan and is assigned a 

length of stay according to the standards approved for this hospital by the 

North Carolina Department of Human Resources. If the original length of stay 

expires and the patient is still hospitalized, the attending physician must write 

an updated treatment plan explaining the need for further hospitalization and the 

Utilization Review Committee must again review to insure that continued hospitalization 

is appropriate. 

Wlth_ these procedures, why. is_ it necessary to submit an entire medical record,^. — 
whicRITicreases.-Our costs-andjibreaches^Tconf identlality^rand ..then'.havelithatTrchar.tL — 
reviewed by a non-physician clerk?: I. realize, Mrs. Honeycuttr, that you are merely 
following standard operating procedures as passed down to you from Washington. 

Nevertheless, I feel so strongly about these matters that I felt I' inust protest 

and I assure you I will continue to do so. until somebody listens, takes notice - 
and does something constructive. 



Sincerely yours^ 





John D. 01ofsT)n 
Admlnlstra 



JDO:mh 



»t^y 



cc: The President of the United Stales, Washington, D. C. 

Mr. Joseph A. Califiano, Jr. , Secretary Health, Education and Welfare 
Washington, D. C. 

Thomas Bryant, M. D. , Executive Director, National Committee on Mental Health 
Washington, D. C. 

Mr. James Glllman, Vice President FEP, 1800 M.Street, Washington^ D. C. 

Mr. Tom Rose, President, Blue Cross/Blue Shield" of North Carolina 
Durham, North Carolina 

Mr. Edward F.X. Lawlor, Jr., Executive Director, National Association of 
Private Psychiatric Hospitals, 1701 K Street, Suite 1205, Washington, D. C. 

Ms. Joy Mldman, Associate Director, National Association of Private Psychiatric 
Hospitals, 1701 K. Street, Suite 1205, Washington, D. C. 

Alfred H. Freedmah, M. D., President National Commission on Confidentiality'' 
of H.fealth Records, Inc., 1701 K Street, N.W.,. Washington, --D, C ::. 

rSVCHIATIIV NCUKOLOOV OERIATHICS 



249 



ORANGE , 
COUNTY 



ORLANDO. FLORIDA 



FLORIDA 



DEPARTMENT OF SOCIAL SERVICES 

ANNA M. LOVELU, MANAGER 

MENTAL HEALTH REHABILITATION UNIT 
2520 NORTH ORANGE AVENUE 
ORLANDO. FLORIDA 32B04 



August 7, 1978 



National Commission on Confidentiality 

of Health Records 
1211 Connecticut Avenue. N.W. 
Washington, D. C. 20036 

Dear Sirs: 

I was very interested in seeing the letter of NDS, Executive Director, 
in an Ann Landers column, and am pleased to know that your agency 
exists. 

My question pertains to mental health: Has your agency addressed the 
problem of mental health confidentiality and the complications that 
have arisen under the heading of accountability? In the state of 
Florida, this is still further complicated by the Florida Comprehen- 
sive Mental Health Act, commonly called the Baker Act; and by certain 
requirements of Health and Rehabilitation Service under reorganiza- 
tion. Among the latter are the Client Information System which will 
viltimately require the listing of name and social security number of 
all persons seen in the Emergency Room for psychiatric screening (as 
does Title XX for all states) for purposes of "tracking" that person 
(client) through all possible services throughout the state. Another 
requirement, which may not be unique to Florida, is that of referring 
client information according to "catchment" areas where community 
mental health centers are involved. 

Releases from clients are required, of course, but as we all know, 
all of this dociomentation and accounting for and shifting around of 
information through so many clerical as well as professional hands, 
lends itself all too readily to breaching confidentiality. 

If you have addressed the matter of confidentiality for mental health 
clients, I would be most interested in knowing what conclusions, 
suggestions and directions you may have reached. Thank you. 

Sincerely, 

''Jane M. Staly a 
Supervisor 

Orange County Mental Health 
JMS/fs Rehabilitation Center 



250 



V-'W 

Building On Yesterday 
To Better Tomorrow 






o 




PLAINFIELD. 

NEW JERSEY 07061 

201-668-2220 



OFFICE OF THE DIRECTOR 
EDWARD J. DAILEY. JR. 



August 5, 1976 



Or. Alfred M. Freedman 

Cha i rman 

National Commission on Confidentiality 

of Health Records 

1700 18th Street NW 

Washington, D. C. 20009 

Dear Dr . Freedman : 

I read with much interest the article in the New York Times of 
15. July 1976 in which your Commission appeals for information on 
incidents involving the violation of patients' privacy through 
the release of medical records by hospitals, physicians or other 
sou r ces . 

A trend which greatly concerns the trustees, administration and 
medical staff of this hospital is the increasing demand by 
gove rnmen t agencies for personal and social data, usually for 
well-intentioned research studies but all too often through methods 
which expose many details in the lives of private citizens. When 
these studies are published, or fed into a computer, or merely kept 
at the fingertips of a c i v i 1 -s e r v i ce busybody, the dangers of in- 
vasion of privacy are greatly magnified. 

A few specific examples in which government is assuming a question- 
able "big brother" role are these. . . 

I. Birth Certificate Information 



The birth certificate application form prescribed by the U.S. 
Department of Health, Education and Welfare, Public Health 
Service, National Center for Health Statistics (PHS Publication 
170't) asks for the following data regarding both mother and 
father of the ch i 1 d : 

Fu 1 1 name 

Age at time of delivery 

B i rthp 1 ace 

Race (White, Negro, American Indian, Chinese, etc.) 

Education (Highest grade of school finished) 

Proposed name of child 

Complete address. Including whether in the city limits 




A COMMUNITY TEACHING HOSPITAL 
AFFILIATED WITH THE COLLEGE OF MEDICINE AND DENTISTRY OF NEW JERSEY - RUTGERS MEDICAL SCHOOL 



251 



In addition, the mother Is asked five more questions: 

How many children are still living? 

How many were born alive, but are now dead? 

How many were born dead? 

What was the date of the last live birth? 

What was the date of the last fetal death (Stillbirth)? 

A sample of this form Is attached. 

You will note that the form explains the many purposes to which a 
birth certificate Is used and states that "these items are confiden- 
tial Information which will be used for medical and health use only." 
However, it is obvious that the facts are fed Into a computer at 
the national leve 1 . 

Here In New Jersey, the State Department of Health has also 
computerized such data as (1) the month of pregnancy In which pre- 
natal care began, (2) the total number of prenatal visits and 
(3) whether or not a blood test for syphilis was made during 
pregnancy and. If so, the approximate date of the test. 

Some of this data may very well serve a useful purpose In the 
reporting of vital statistics and may also serve as a guide In 
directing health care to critical areas, but it also constitutes 
further evidence of the mounting mass of personal and sociijl in- 
formation now being stored in computer banks. The chances of this 
highly personal data becoming available to others would seem to be 
cons i de rab 1 e . 

2. Abortion Records 



This hospital Is currently engaged in a disagreement with the 
State of New Jersey Department of Health concerning certain in- 
formation requested on monthly "abo r t i on/ i ndu ced pregnancy 
termination reports." We believe the requests of the Health 
Department constitute an even more flagrant disregard of patients' 
rights than the information we are required to give on birth 
certificate application forms. 

We are asked to report the following information on each abortion 
or induced pregnancy case: 

Case number 

Date of abortion 

Gestation period at termination (number of weeks) 

Method of termination 



We have no argument with the above and have reported these 
statistics. However, we believe that the following information 
requested by the Department represents an invasion of privacy 
by creating a personal profile which can easily result In the 



252 



itJ'entIf fcation of the mother, even though the actual 
names are not Involved. 

Age 

Marital status 

Residence (city, county, state) 

Race or ethnic group 

Prior number of pregnancies 

Prior number of live births 

Prior number of Induced pregnancy terminations 



Although names are 
one with access to 
the identity of the 
communities where t 
i n large cities. 

The New Jersey Atto 
information on abor 
the I nd I V i dua 1 . We 
counsel , have decl i 
believe might jeopa 
volved. Throughout 
al 1 poss lb 1 e steps 
and we bell eve the 
and careful In its 



not included in the abortion records, some- 
these records could. In many cases, deduce 

parent. This is particularly true in small 
he number of abortions would be fewer than 



rney General does not Interpret the requested 
tions as violating the right of privacy of 

feel otherwise and, on the advice of legal 
ned to submit that Information which we 
rdize the Identity and rights of those In- 

the hospital stay of the abortion patient, 
are taken to protect the patient's privacy. 
State of New Jersey should be as judicious 
own recording of personal data. 



A copy of the State's Abortion Report and pertinent correspondence 
are attached. 



Cancer Studies 

A less clear situation but one that may place hospitals in a 
precarious legal position Is the growing demand by the public 
for more information on the causes of various types of cancer. 
The government, responding to this need. Is conducting an In- 
creasing number of in-depth surveys of environmental factors 
involved in the incidence of cancer. This, of course, requires 
close attention to many details in the private lives of patients, 

The State of New Jersey Department of Health has instituted a 
statewide study on cancer of the bladder, which involves the 
review and photocopying of numerous medical records. If it 
becomes necessary to contact persons directly, prior approval 
will be obtained from attending physicians, according to a 
statement from the Department of Health. 



253 



The concern of physicians and hospitals that this could lead to 
possible litigation by patients' families has caused the State 
Attorney General to Issue a detailed defense of the practice. 
The Attorney General has concluded that "such inspection by 
the Division violates no constitutional or legal rights of the 
facilities, physicians or patients." The Attorney General 
states further that such inspections of records "for purposes 
of public health research do not result In the breach of a 
health care facility's duty of confidentiality to its patients 
nor do they violate any personal rights of privacy even when 
conducted without the consent of the patients." 

The conclusion Is well documented with data on previous legal 
cases. I think you will find the Attorney General's findings 
and conclusions of particular Interest to your Commission, as 
undoubtedly more and more conflicts will result as the number 
of studies relating to cancer and other diseases are stepped 
up throughout the nation. The statement is attached. 

In addition to the three specific cases described above, the New 
Jersey State Department of Health has now initiated computer 
abstracts of all patients. We do not think we can legitimately 
oppose this but we do not favor the program. Presumably the Informa- 
tion will be used (as in the cancer studies) In developing a profile 
documenting certain Illnesses, but here again we believe the 
surrender of personal files to the State constitutes an invasion 
of the Individual's privacy. 

All too often, we believe, the government asks for information It 
does not really need in the pursuit of better public health. It also 
occurs frequently in the settlement of claims, including hospital 
payments, as in the requests by Medicare and Medicaid representatives 
for photocopies of detailed personal data, including nurses' and 
social workers' notes, which may pertain to a patient's mental condi- 
tion, or other Information which could endanger his or her employment 
or social relationships with others. 



Muhlenberg Hospital Is quite conscious of the possibility of leaks 
of confidential information, either Intentionally or inadvertently. 
We have a strict policy that personal Information about a patient 
or former patient, including all the facts of the patient's medical 
records, must not at any time be divulged to anyone other than the 
physician who Is diagnosing, treating or consulting In the patient's 
case, or a government representative, police officer or attorney 
who presents the proper credentials and reasons for the request. 



254 



Our personnel must constantly make decisions on whether requests 
for information that appear to be legitimate are rightly so. 
People posing as physicians, who may in reality be insurance 
Investigators or just curious relatives or "friends," often 
request highly personal data. 

We have had requests from separated persons for the medical details 
of their spouses, and from unwed couples attempting to prove or 
disprove paternity. Recently a man asl<ed the hospital for the blood 
type of a child. When the request was denied, he had a woman pose 
as the child's mother and make the same request. Because of the 
likelihood of other incidents such as this, the hospital never 
releases personal information by telephone. Often a subpoena is 
necessary before such information can be given out. 

Many other examples exist In hospitals of real or potential violations 
of the right of privacy. I am sure that a more detailed study of 
our own hospitals' experience would produce additional cases of 
possible interest to your Commission. However, in the interest of 
expediting your research, I have forwarded these incidents as 
promptly as possible. 

I wish you success in your study and would appreciate your sending 
me a copy of any reports which you believe might be of interest to 
us . 



Very truly yours. 



Edwa rd J . 
D i rector 



EJD:jp 
Attachments 





255 



ALWAYS READY 

UNIFORMED FIREFIGHTER'S ASSOCIATION 

of the Village of Scarsdale, Inc. \y« 

P.O. BOX 61 fr^e 



SCARSDALE, NEW YORK 10583 ALWAYS ALERT 




National Conmlsslon on Confidentiality of Health Records 

1211 Connecticut Avenue 

Washington, D.C. 20036 June 1, 1978 



To whom It may concern, 

I am writing to your organization at the request of the members 
of our association which represents the fire fighting force of the 
Village of Scarsdale, New York. I will try to consolidate the 
member's questions for you as briefly as possible. 

First; Approximately three years ago, the "Village" mandated that 
ALL fire fighters will receive an annual physical exam, which Is 
administered by a local physlcan and his staff at the hedlcal Center 
in Scarsdale. This exam is paid for in full by the "Village' (at a 
cost of approx. $95.00 per man) and is quite extensive and thorough. 
The Justification for the exam is obvious, however a majority of 
the memberi feel it is an infringement of their rights, in the way 
the exam and it's findings are handled. The most common gripe 
is that the results of the exam are kept on file in each man's 
personal record ana are easily available for inspection by many if 
not all Village administrators and their staff, whether or not 
the person handling the file has anything to do with medical 
or fire department business. Question: Who may have access to 
these records and how are they to be kept secured 

Second; In line with the above, can a member tell the 
examining physlcan he (the member) does not want any of the 
findings, positive or negative, released to the "Village", only 
that he his fit or unfit to perform his Job as required? Could ^^ 
a member refuse any findings whatsoever to be given to the "Village ? 

Third; A member is not given a copy of the exam, however one 
will be mailed to his family physlcan If requested. In the same 
light, a member is given the right to have his own physlcan examine 
him (as per "Village" instructions as to which test are to be given) 
however a copy of the exam MUST be forwarded to the Village. Once 
received the "Village will pay all costs up to $95.00. NOTE: On 
an Individual basis the exam and test usually costs about ^140 to 
$150. If the "Village does not receive the results as requested 
It may subject the member to disciplinary action. Can one refuse 
to submit the finding to the "Village" on the premise on doctor/ 
patient relation? 



256 




ALWAYS READY 



UNIFORMED FIREFIGHTER'S ASSOCIATION 

of the Village of Scarsdale, Inc. 

P.O. BOX 61 

SCARSDALE, NEW YORK 10583 




ALWAYS ALERT 



Forth; May copies of an Individual's exam be sent to 
medical Insurers or other agencies which the "Village" Is associated 
with, without prior approval of the Individual? How can this be 
prevented as In the first question I asked? 

Fifth and lastly; May the findings of an exam, which may not 
affect Job performance be used against a member, and may that member 
be given a certain time to correct the problem or face possible 
disciplinary action? 

There are a great maiy more related questions whlcrh have come to 
my attention, however with the basics I have given you, IVn sure you 
can figure about what they are in reference to. In your opinion 
what is the legality of the exam and how the results are handled? 
Also any comments or related Information would be appreciated. 
If possible, when you reply, please send a copy of your reply to 
my home address listed below as well as to our organization's 
P.O. box. (Please mark envelope ATTN W.F. FELICE). Again, thank 
you for any Information which you may give us. 

Sincerely, 




(HOME) 



if^teFF.^ellce - Sect'y 

RD 3 107a Oscawana Lk. Rd, 
Putnam Valley, New York, 10579 



257 




(lY.p'iiitr'S 



National j^ssociation of K^etter (Carriers 



BRANCH 4607 
FREMONT, CALIFORNIA 94537 



National Coramisslon on Confidentiality 
of Health Records 
1211 Connecticut Ave., N.W. 
Washington, B.C. 2OO36 

April 30, 1978 

Deax Sirs, 

Our members have been faced with a frustrating and recurring 
problem Involving members of your organization. Supervisors in the U. S. 
Postal Service have taken it upon themselves to contact the physicians of 
employees who have submitted medical certification for extended absenteeism 
due to illness or Injury. Upon phoning the doctor, they ask rather intimate 
questions regarding the employee's physical condition. The supervisor al- 
ways has received this information with little or no question. On several 
occasions the supervisors inferred that the patient was in danger of losing 
his job if he covild not return to work promptly- whereupon the doctor, 
believing he was helping the patient, changed his prognosis to suit the 
Postal Service's needs. 

We are appalled that such imformatlon is given so freely over the phone. 
Are we incorrect in the belief that the doctor-patient relationship is 
supposed to be private? Are not the doctors and/or their assistants wrong in 
releasing or discussing this Information without the consent of the patient? 

We are planning to distribute a printed form to our members which instructs/ 
the attending physician not to discuss his condition with anyone without written 
permission. The employee would give this form to the doctor if and when he 
receives treatment. Is this proper? 

We would appreciate any opinions or suggestions you can give on the afore- 
mentioned matters. A prompt response would be most beneficial to our members. 

The above letter was sent to the AHA and the CMA, they dldnot give \is 
nuch to go on. Would appreciate anything you could do for us. 

Sincerely, r. 

Bellte Askelson, 
secretary 



258 



WHITEFLINT PROFESSIONAL BUILDING 

lilts ROCKVILLE PIKE 

ROCKVILLE. MARYLAND 20BS2 



(t>HOHEt es 1-3443 



DONALD L. HILTZ. R. P. T. 
CHARLES A. KIBBEY. R. P. T. 
RALPH U SHERWOOD, R. P. T. 

PHYSICAL THERAPY 



November 23, 1977 



FOXHALL SQUARE BUILDINO 

SSOt NEW MEXICO AVENUE. N. W. 

WASHINGTON. O. C 200le 

Phohci Bse-7111 



Natalie D, Splngarn, Director 
National Corranlsslon on Confidentiality 

of Health Records 
1211 Connecticut Avenue, N.W. 
Washington, D. C. 



Seer Me. 'Splngarn: 

In February, 1977, I was called by Mr. William Rhoda, who 
Is with the Division of Licensing and Certification in the 
Maryland Department of Health and Mental Hygiene. He informed 
me that my Whitefllnt office would be surveyed on April 28, 
1977, by Mr. Robert Schwartz. The purpose of this survey was 
to determine by compliance with Federal Regulations governing 
Medicare. 

During the survey, Mr. Schwartz indicated he wished to review 
records of patients not covered by Medicare. I might add at this 
point that the Medicare form which patients sign contains an 
authorization for review of their records by officials of the 
Social Security Administration. Obviously, Mr. Schwartz had no 
such authorization to review any other files or patient records. 
This being the case, I refused him access to any records, other 
than those covered by Medicare. He cited the State Operations 
Manual, section 2A80.5 which gave him the authority to examine 
any records which he picked at random. Nevertheless, I still felt, 
and still feel, that patients' records are confidential and cannot 
be examined without their express written consent. He was not 
allowed to review any records other than those for which he had the 
patients' permission. 

I learned two weeks ago, from Mr. Schwartz, that my Medicare 
certification was not going to be renewed because of my refusal to ( 
open my records to the survey. * 

I have written to Congressman Steers and asked his assistance. 
I now appeal to you for help also. It Is Incomprehensible to me 
that this situation has arisen. It ^s Impossible for a practitioner 
t>o adhere to professional ethics and standards of practice and 
maintain certification with Medicare. If this does not represent 
Invasion of privacy by the Federal government, what does????? 

Very truly yours. 



DLH/rmc 



nonald L. Hlltz, R.P.T. 



259 



WHITEFUNT PROFESSIONAL BUILDING 

tills ROCKVILLE PIKE 

ROCKVILLE. MARYLAND 20692 

PM0NC> ae 1-3443 



DONALD l_ HILTZ. R. P. T. 
CHARLES A. KIBBEY. R. P. T. 
RALPH L. SHERWOOD. R. P. T. 

PHYSICAL THERAPY 



December 12, 1977 



^<^_ 



FOXHALL SQUARE BUILDING 

S301 NEW MEXICO AVENUE. N. W. 

WASHINGTON. D. C 200ia 

PHONCi see-7111 



Natalie D. Splngarn 

Executive Director 

National Commission on Confidentiality 

of Health Records, Inc. 
1211 Connecticut Avenue, N,W, 
Washington, D. C. 20036 

Dear Ms, Splngarn: 

I received your letter of December 6, 1977 regarding tny 
problems with Medicare. I sincerely appreciate your efforts on 
Biy behalf, and on behalf of my patients who do not wish their 
records opened before Federal surveyors without their consent. 

I have contacted the local chapter of the A.C.L.U. and have 
been advised that they feel that this represents a violation of 
civil liberties. The local chairman, Gary Simpson, has written 
roe and advised that one of their attorneys will be in touch shortly. 

In reply to your question regarding my letter, I would be 
most happy to have you use my name. I would be available to 
personally testify because 1 have such strong feelings In this 
area. 

If the government Is allowed to Invade records as It chooses, 
George Orwell's 1984 will be upon us long before then. The thought 
of that actually occurred frightens me. 

Thank you again for your cooperation and assistance. 

Very truly yours. 



Donald L. Hlltz, R.P.T. 



DLH/rmc 



260 



DONALD 1_ HILTZ. R. P. T. 
CHARLES A. KIBBEY. R. P. T. 
RALPH U SHERWOOD. R. P. T. I 

PHYSICAL* THERAPY j *\ ^^ ^ 

WHITCFLINT PROFESSIONAL BUILDING A X "^ 3 FOXHALL SQUARE BUILDING 

lilts ROCKVILLE PIKE VaJ "**' "^ MEXICO AVENUt N. W. 

ROCKVILLE. MARYLAND 20BS2 ^ if WASHINGTON^D. C ZOO 1 8 

PHONE.l8t.3443 I PMOHI. B8S.7U I 

January 16, 1978 



Ms. Natalie D. Splngam, 

Executive Director 

National Commission on Confidentiality 

of Health Records 
1211 Connecticut Avenue, N.W. 
Washington, D. C. 

Dear Ms. Spingarn: 

On Wednesday, January 11, 1978, I participated in the filming 
of a segment to be aired in March. Paul Sandenman contacted me 
in this regard, apparently after being referred by you. 

Interestingly, on January 12, 1978, William Rhoda from the 
State Department of Health and Mental Hygiene called to advise 
that I had been recertified by Medicare. I have, of course, contacted 
the T.V, station because of this sudden change in posture on the 
State's part. 

For whatever the reason. Medicare has decided that I may 
continue to be reimbursed for my professional services. Perhaps 
the heat was too great, but, nevertheless, the government still feels 
that it has the right to review patients' records without the consent 
of the patients. 

I am personally glad this entire matter Is over. However, the 
problems remain and will probably crop up again next year during the 
survey. 

Please keep up the good work. If I may be of any assistance, 
please feel free to call upon me. 

Very truly yours, 



Donald L. Hiltz, R.P.T. 



DLH/rmc 



261 



DRUG ABUSE REHABILITATION SERVICES: 

• MENTAL HEALTH CLINIC (DRUG-FREE); 

• METHADONE MAINTENANCE TREATMENT; 

• SU CASA: DAY AND RESIDENTIAL METHACX3NE- 
TO-ABSTINENCE REHABILITATION; 

• COMMUNITY PREVENTION & EDUCATION 



Edward M. Brown 
Execytive Director 

Htrkert B»ri«h. C.S.W. 
Assistant Director 

Kevin Quinn 
Administrator 



March 20, 1970 



Ms. Toby Levin 

National Commission on Confidentiality 

of Health Records 
1211 Connecticut Avenue, N.W, 
Suite 504 
V/ashington, D.C. 20036 

Dear Ms. Levin: 

As you are aware from our phone conversation, this 
agency has just undergone a site visit from a Per- 
formance Review Team from one of our funding agen- 
cies, the New York State Office of Drug Abuse Ser- 
vices. Our records have been read in the past year 
by: 

- a three person team from the New York 

City. Medicaid Department of Social 
Services 

- a representative from the New York_State 

Department of Mental Hygiene " 

- a representative from the N^w_Yorlc City 

Substance Abuse Services Office 
(funding support) 

- our contract manager from the New Yo^'k 

State Office of Drug Abuse Services 
CfuSding Support) 

- four members of the above .mentioned Per- 

formance Review Team 

Granted that funding agencies have a right to inspect 
records, but it seems to me that opening records to 
ten people in the course of one year meikes a mockery 
of confidentiality. 

Me are also concerned with the qualifications of the 
reviewers. They generally lack professional training 
and the attendent emphasis on ethical standards. 
Only the representative of the New York State Depart- 
ment of Mental Hygiene held a license or certificate 

A noo-orofil U. <««Juc1.bl.. chJMUhle coT>or.t«n «c.«).I«» tw tt» '^'^ ^"•'' ;-;;' 



262 



in a mental health profession out of the ten individuals men- 
tioned . 

I \irould like to share one example of the naive, almost primitive 
quality of some of the individuals who have access to our records. 
There was considerable giggling at the description of our clients 
psychotic symptoms by the members of the Performance Review Team. 
It is indeed worrisome that individuals so unacquainted with the 
field can read records. Who knows what gossiping went on when 
they reached home? ^'Hio knows what punitive reactions of anger 
and disgust at our clients anti-social behavior could occur? Who 
knows what personal advantage might be taken of clients upon dis- 
covery of compromising situations such as that of cin ex-prosti- 
tute client now in graduate school? I do not. 

We are writing to ask that your organization address itself to 
these two issues. We would also appreciated it if you can help 
us discover any legal remedy to this situation or standardized 
criteria for case file monitors and reviewers. 

Sincerely yours. 




Richard S. Klotz, M.S. 

Clinic Administrator / 

RK/n-/ 

cc: Edward Bro\m 

Herbert Barish 



263 



National CoMMrssioN on Confidentiality 
OF Health Records 
1700 i8th Street NW 
Washington, DC 20009 

Dear Sirs: 

I appreciate the opportunity to have some imput into your proceedings, a 
point that I think that would be worthy of your consideration is the rela- 
tionship OF the private practitioner to local Welfare Departments and the 
Welfare Department's right to access to medical records on the Welfare 
CLIENT. Specifically a frequent event in my local area as a private practi- 
tioner of Pediatrics is for me to receive a phone call from a person who 
identifies themselves as a member of the Department of Public Welfare and 
who on th- telephone requests information regarding recent medical care 
given to a Welfare patient who is a recipient of either Medicaid assistance 
OR Medicare Supplemental Security Income Assistance. 1 find this a very 
awkward request to answer on the telephone since I have no direct authorit y 
from the patient th emself and since this information is often prejudicial 

IN MY opinion to THE PATIENT'S INTEREST. IF WE WERE TO RELATE THIS TO THE 
PRIVATE SECTOR OF OUR ECONOMY, AN INSURANCE CARRIER REQUESTING INFORMATION 
ON A PATIENT WOULD BE REQUIRED TO PROVIDE A SIGNED AUTHORIZATION FOR THEM 
AND THIS WOULD HAVE TO BE IN MY HANDS BEFORE I WOULD RELEASE INFORMATION 
TO THE INSURANCE CARRIER. IT MAY WELL BE THAT THE WELFARE CLIENT HAS GIVEN 

THE Welfare Department the authority to seek information, however, I have 

NO COPY in my hands AT THE TIME THIS INFORMATION IS BEING SOUGHT AND I 

think that this procedure needs clarification. as it stands at the moment, 
i generally decline to give out the information and somehow the welfare 
Department generally found themselves able to live without it. 

Another specific area that I find to be abusive of patient confidentiality 

IS WHEN THE STATE DEPARTMENT OF WELFARE OR SOME BRANCH OF THE DHEW SENDS 
A LETTER TO ME REQUESTING INFORMATION REGARDING RECENT GOVERNMENT SUBSIDIZED 
PATIENT VISITS, AND THERE IS NO ACCOMPANYING AUTHORIZATIO N FORM FOR ME TO 
RELEASE INFORMATION TO THAT BUREAU. AGAIIN, I GENERALLY DTULINE TO RELEASE 
THE INFORMATION AS I WOULD IF I WERE DEALING WITH A PRIVATE INSURANCE CARRIER. 

I WOULD APPRECIATE THE COURTESY OF A RESPONSE TO THIS LETTER AND WOULD ULTIMA- 
TELY WOULD HOPE TO BE ABLE TO SEE A COPY OF YOUR RESULTS OF YOUR PROCEEDINGS. 



i wish you success in your endeavors. 

Sincerely yours, 



264 

July 15, 1976 

Alfred M. Freedman, M.D. 
1700 18th Street N.W. 
Washington, D.C. 20009 

Dear Dr. Freedman, 

I have had two unwarrented intrusions upon the confidentiality of my medical records over the past 
three years. The, insurance Company, who ore the agents for Medicare in this state has 

hod two intensive reviews of my patients medical histories in what they claim was a search for 
utilization review. The last occasion, approximately one year ago, they photocopied every page 
of the records of ten paitents. I consulted my lawyer who told me that I had no choice but to 
co-operate since the signing of the claim form for payment was an automatic release of information , 
This is obviously a qeo^9Esn "Catch 22" in that unless a form is signed, the patient or the doctor 
cannot be repaid. If the form is signed, an^' automatic release of information against my better 
judgement is required. I do hope this information will be of assistance to you. 

Respectfully yours, ^ 



M.D.,P.A. 
MSAap 



265 



Dctober 5, 1977 



Natalie Davis Spingarn 

k^ational Commission on Confidentiality of 

Health Records, Inc. 
1211 Connecticut Ave., N.W. Suite 504 
Washington, D.C. 20036 

Dear Ms. Spingarn: 

I am writing to you to detail one of the most outrageous 
violations of civil rights and private patient medical 
Becords confidentiality in existence today. 

A conflict::^xists in the State of Illinois between the 
Illinois* Department of Public Aid and the physicians of 
Illinois. Basically, Illinois physician s hav e in sis, ted 
on written re leasef rom th e_p_atient for the date of visit 
TiTquestibn wheTTmedical records are requested by the 
Illinois Department of Public Aid for review in audit. 
The State's position is that no such release is required. 
Litigation is pending in several law suits filed against 
the state on this issue. The Illinois State Medical , 
Society has filed Friend of the Court Briefs in favor of 
protecting confidential medical records. 

In Illinois, no such release or documentation has ever 
been obtained, and the state is absolutely wrong, we feel, 
in their position. They have used coercive powers inclu- 
ding the threat of suspension and termination from the 
Medicaid program to force Illinois physicians to give up 
these medical records. The problem is more acute because 
political hacks, retired policemen, and other non-profes* 
sional — unprofessional individuals have received access to 
these records and have reviewed them in medical offices 
around the state. Further, random Xerox copies of medical 
records have been made in the medical offices without per- 
mission and without knowledge of Welfare recipients, and 
taken from the premises;. 

In Illinois, as in other states, no one questions the right 
of government to insure that it gets what it pays for. On- 
going audits are excellent , if properly carried out. In 
Illinois, these audits have been the subject of much contro- 
versy, since they involve the illegal search of medical 
records ^y incompetent, untrained medical personnel, - vm- 



266 



Natalie Davis Spingarn 

Page Two October 5, 1977 

skilled in review of complex medical data . Further, no 
protective mechanism exists for protecting the confidentiality 
of these records. Last, but not least, patients are unaware 
that records of their venereal disease, marital infidelities, 
occult cancers, and other confidential records are being in- 
discriminately bantied around the state. 

In Illinois, considerable documentation exists that suggests 
that the audit procedure is unprofessional, token, and done 
strictly to attempt to meet HEW requirements. 

Many physicians in Illinois feel that if an audit is being 
performed, and if the expense of such an audit is to be under- 
taken, little extra cost is obtained if written releases from 
patient's records being audited is obtained in advance. No 
substitute for this protection exists. 

It is interesting to note that no wher e, in private industry 
or in Medicare does the principle of 6ivrt>je, a.way in advance, 
for specific period^ of time. the confidentiality of one's medi- 
cal record. 

I've enclosed a letter of August 11, 1977, from the Director 
of the Illinois Department of Public Aid to the Regional 
Commissioner of HEW. This record documents the position of 
the State and requests HEW's approval for one of the most 
precedent-setting and offensive assaults on confidential 
medical records. This proposal would require any Medicaid 
recipient to sign away, in advance, the release of, and the 
confidentiality of his medical record for the month he re- 
ceives his Medicaid card. Refusal to do so would result 
apparently in ineligibility for Medicaid. The Ad Hoc Committee 
on Public Aid to the Chicago Medical Society has gone on record 
as being extremely upset with this proposal. The Illinois 
Department of Public Aid has worked out this method of allevia- 
ting mediciBelscooneenn over the release of these records in 
this shallow, callous fashion. 

Many of us in Illinois will be working long and hard to defeat 
this proposal. Any help you can give us would, of course, be 
appreciated. Please remember again that Illinois physicians 
believe government is entitled to review records in an attempt 
to audit proper payments. It is not too much to request 
written release from a patient for the date of visit in ques- 
tion. It is not too much to ask government to take that small 
step to protect the patient and to give him the opportunity of 
refusing to release sensitive personal data to the vast federal 
bureaucracy and its incredible computer system. 



267 



December 4, 1978 



Ms, Natalie Spingarn, Executive Director 
The National Commission on Conf identality 

of Health Records, Inc. 
Suite 504 

1211 Connecticut Ave., N.W. 
Washington, D.C. 20036 

Dear Ms. Spingarn: 

In October 1978 the Executive Board of the New Jersey Psychologi- 
cal Association formed a committee on the Utilization of Professional 
Services to represent the profession of psychology in New Jersey in its 
contacts with the various state agencies and state programs which itil- 
ize psychological services. One of the programs we have been very in- 
volved in is the New Jersey Medicaid Program administered by Mr. Thomas 
Russo, Director, Division of Medical Assistance and Health Services in 
the Department of Human Services. 

In the process of exploring a number of problems which have arisen 
between the members of our profession and the administrators of the 
Medicaid program, it occurred to us that there may well be legal issues 
involved with which you may wish to concern yourselves. Briefly, these 
appear to be issues of: 

1) the violation of the Medicaid client's right to confidential- 
ity as provided under the 1968 Psychology Licensing act 

2) issues involving infoinned consent 

3) issues involving due process 

4) issues involving self incrimination. 

We are concerned that certain civil rights of Medicaid cleints, as 
consumers of mental health services, are being violated and that certain 
civil legal rights of psychologists are being violated. 

The Division of Medical Asssistance and Health Services contans an 
office of integrity which has a watch-dog function to prevent abuse. 



268 



fraud, etc. When its computer indicates that a particular practitioner 
is providing services in a pattern which is different fiom other pro- 
viders, the office of integrity may send a field investigator to the 
office of the practitioner to validate that the services which were 
claimed were in fact provided. The claim form (a sample is enclosed) 
contains two items: No. 16, patient's certif icstion, and No. 17, pro- 
vider certification, which apparently give the investigator the right 
to examine the records of the practitioner including the personal fold- 
er of the client. 

The practitioner is not eligible for reinbursement unless both cer- 
tification items are signed and the client is aware that the practi- 
tioner will not continue to provide services to that client unless the 
claim form is signed. In certifying that the services were performed 
as billed for, both the client consumer and the practitioner appear to 
be forced into waiving their rights to confidentiality which the 1968 
Psychology Licensing Act guarantees. 

Thus, when a field investigator conducts an audit of a practitioner, 
the psychologist feels in fear of legal consequences if he does not co- 
operate in showing all records requested; these may also include re- 
cords (e.g. appointment calendars) which contain the names of non-Medi- 
caid clients. The rights of the provider in refusing to make certain 
records available is not explained. In fact, none of the rights of the 
patient or provider are ever explained. 

The progress notes of a psychotherapist, whether psychiatrist, psy- 
chologst, psychiatric social worker, or pastoral counselor have tradi- 
tionally always been regarded as a private and confidential personal 
record for the practitioner himself and NOT as a public record or as a 
communication to others. In that sense there is a significant and fun- 
damental difference between the records of an independent psychothera- 
pist in a private office and a medial chart in a hospital. There is 
extensive precedent establishing the importance of and the legal pro- 
tection given to a patient's right to confidentiality. 

Yet, the field investigator apparently has the right to demand to 
see these confidential progress notes and to make a judgement as to 
whether these records are sufficient to document the actual provision 
of service. The length, detail, legibility, or any other aspect of a 
therapist's private progress notes are not a valid measure of the' ex- 
tent of or quality of service provided. Indeed, many therapists have 
learned not to keep any progress notes at all as a way of insuring their 
patient's rights to privacy; these practitioner's are being judged as 
failing to keep proper records and are subject to administrative action 
by the Medicaid program (which can range from a warning, through sus- 
pension, suit for recovery of funds, to legal action) . 



269 



The data obtained from the field investigation is reviewed and if 
there seems to be evidence of illegal practice, the field staff report 
is turned over to the Legal Action Committee of Medicaid. A deptity at- 
torney general is present at these meetings and may decide he wants a 
case referred to the Divisionuof Criminal Justice for further review. 
Once the Division of Criminal Justice decides to take a case for pos- 
sible criminal prosecution, Medicaid no longer has jurisdiction over 
the case and its final disposition. In fact, Medicaid is prohibited 
by the attorney general's office from advising the provider in any way 
that his case is under investigation by the Division of Criminal Jus- 
tice and that he may be prosecuted or that investigative findings may 
be turned over to a grand jury. 

We feel that the issues involved - right to confidentiality, in- 
vasion of privacy, informed consent, and due process - are extremely 
important; that only a particular segment of the population if sub- 
jected to these circumstances makes it seem especially important. We 
will appreciate your response to these matters and whether your office 
feels our concern is justified and, if so, how we can aid in facilitating 
corrective action. Thank you for your help in this matter. 

Very truly yours, ^ 



270 



DAVID C WILSON 

Neuropsyiihialric HosjMlal 



June 15, 1977 



Owen W. Brodie, M.D. 
Prosirlont, Neuropschiatric 

SorriGty of Virqinin 
1500 Westbrook Ave. 
Richmond, Va. 23227 



Dear Owen; 



In the course of our recent dealings with Blue Cross 
and Blue Shield, v/e have recently encountered a 
problem which might v/ell deserve the consideration 
by the appropriate comrnittec of the State Society 
UL well as the Virginia Chapter of the NAPPH. 

riue Cross and Blue Shic-1^1 has recently advised us 
~hzt they plan to audit all^ hospital charts over 
2 three month period (but only from hospitals who 
submit their claims "manually") and that they vjill 
withhold paiTTient on these claims until these audits 
cire completed. In most instances, they have re- 
quested copies not only of the admission histories 
and discharge summaries but also of all progress 
notes. Obviously, this will play havoc with our 
cash flov;s system. From a clinical standpoint, 
T am concerned aV'Ovit ^-h^ extent and nature o f 
confidential material which will be released , pre- 
somably for routine review and r^creening by lay 
i ^i-^rr.onnel in the Blue Crocs offices. I am sure 
cnat luue Cross' request ir. legally justified in 
that patients do sign the usual authorization for 
release of information. I rather doubtt, however, 
if this is indeed an [informed consent] in that 
patients are av/are of ^^ the extent and -nature of the 
highly personal information which is thereby made 
available to others. From a professional stand- 
point, I vjould suggest that this particular problem 
be brojght to the attention of the insurance 



271 



co.-mnittee of the Neuropsychiatric Society of Virqinia 
for their consideration. From the standpoint of the 
11 private psychiatric hospitals in Virginia (at 
least those which admit patients covered by the 
Richmond Blue Cross plan) , I would think this matter 
would be of equal concern to the Virginia Chapter of 
the National Association of Private Psychiatric 
Hospitals. 

Thanking you for your consideration of this matter, 
I remain, v/ith all best personal regards. 



Most sincerely. 



:vMS/st 

cc: Dr. B. R. Ashby 
President-elect 

Dr. John Buckman, UVA Med. Center 



Dr. Stuart Ashman 
Medical Director, T.P.I, 



272 

Till- iJavii! C. Wilso n Ncnr oiv.ythiatric fiosgital • C h.irV.ilh'svilk.A'ii>;iiiu» 2I'\M 



AT'S^^ZTW^-^-Ci^/^-o-r 



z-^- 



April 25, 1978 



National Commission on Confidentiality of Health Records 
1211 Connecticut Avenue N. W. 
Washington, D. C. 20036 

RE: Michigan Medical Care Advisory Council 

I have been appointed to an advisory group to the Michigan 
Medicaid agency. I learn that confidential medical information, 
including diagnosis and detail of treatment, is submitted, as 
to every recipient, to the agency, which stores it in a computer, 
which is available for authorized (and perhaps una-thori zed) 
scrutiny. 

While widely done, both in government circles and in private 
health insurance, I think it represents a deviation from 
ethical standards. I wonder if you could tell me how wide- 
spread the practice is, and whether there are programs that 
protect the individual patients' records from being duplicated 
at places other than the place of the treatment. 
^ n _ 



273 

January 19, 1977 

Ms. Natalie Davis Spingam, 

Executive Director 

National Commission on Confidentiality 

of Health Records, Inc. 
1701 K Street, N.W., Stiite 1205 
Washington, D.C. 20006 

Dear Ms. Spingam: 

Thank you for your letter of December 20, 1976 and the 
most interesting materials which accompanied the letter. 

My feeling about your assignment is that it may he a 
well intentioned effort coming all too late. 

3?he mood of physicians generally is resignation in the 
face of what seemd overwhelming social legislative and judicial 
decisions which have cut sharply into the patient/doctor rela- 
tionship and have created a mood of hopelessness regarding the 
possibility of preventing patient's records from exposure. 

Let me share an incident with youi At the meeting of the 
Huron Road Hospital Active Staff we considered several amendments 
to the bylaws. Among them was one which would regard all charts 
as belonging to the hospital and make all previous charts avail- 
able to the new treating doctor for each successive admission. 
When I recommended that the patient be consulted regarding who 
should see his records and suggested that there were instances 
in my experience where patients emphatically did not want 
certain physicians to see their past records, I was received 
with some amazement by my colleagues. 

The best I could was insist that the matter be referred to ■ 
legal counsel so that the question of whether or not a patient 
had a "right" to limit who saw his medical records could be 
assessed. 

IBhe present generation of psychiatrists seem now to deal 
with the matter of protecting the patient by sharply limiting 
what is put in the record. This is now proceeding to a point 
where medical records are virtually useless for research and 
barely acceptable for patient management. Double ajid even 
triple records are being kept in some institutions. One for 
"show and tell" and. the other as a working increment for the 
doctor's practice. 



274 



APRIL 25, 1978 



National Commission on 

CoNr I DENTAL I TY OF HE AL TH* R ECOROS 

1211 Conn. Ave. 

N.W. 

Washington O.C 2OO56 

To WHOM IT MAY CONCERN, 

I RECENTLY HEARD ABOUT YOUR ORGANIZATION AND I AM 
WONDERING IF YOU CANASSISTME. 

I HAVE HAD A PROBLEM WITH BREACH OF CONF I D E NT AL I T Y OF MY 
MEDICAL RECORDS IN A> BoSTON HOSPITAL. ALTHOUGH., THE PERSON WHO 
SOMEHOW GOT AHOLD OF THE RECORDS HAS AN OUT OF COURT ORDER TO 
STOP HARASSING ME, NOTHING HAS EVER BEEN DONE ABOUT THE RECORDS. 

Frankly, it has caused me great pain and'iworry about If 

Also, several friends of mine recieveo phone calls and given 
information from the records. The information which ,of course, 
they informed me about was accurate and could only be known by a 
person who had access to my records. 



I HAVE WANTED TO RESOLVE THIS MATTER FOR M ON T H S . B U T . F R AN K L Y I 
WHAT TO DO AND THEREFORE, I LOOK FORWARD TO HEARING FROM YOU. 



DON ' T KNO 



'INCERELT, 



275 



-Z.si'L.L^ 



e^3 /9 P'/' 



\_^fCA^ ^/y^ctZ^^"-^ 










02 






'^ 







-A.^ <?-A-^ yf-^'^ 







276 




J'~.<^ /LAA^>iX-<_v^ ^^--t- yO~^^ yt:^-^ y-A^-t^t^AjC^ ,-/C.^-_«i^ 



277 



( r J I - ( ^ 



o'TvJk. 



^N^v^ ^^^/^ ^^'V^O o£./^Jc^ Q^A^.A\or^i^ \ ^*^-^ • 
JJ^.... -^^^ ^-^ vA V^cl ^^-^^-- 

AxS\ X/^^j^-o JLav^ crvN\v:A>^o.r^ 3 Cx./^'vc^ vi 

'v-A:^^ (^'xr^avAo CA-A/VAy\ AvlI/T* <<WT\X- 



278 

April 29, 1978 



Gentlemen I 



Tnls letter is In relationship to an article I read In the Denver Post, 
April 23, 1978 edition of Ann Landers. I am writing this letter 
regarding my specific problem. 

Approximately 10 years ago, at the age of 19, I was committed to a 
mental hospital. I spent about 2 weeks there and never returned as 
an in-patient. I never returned to any other hospital on an in- 
patient basis, and the primary motivation of my conscious or unconscious 
decision was because of the disguistlng aind inhuman way. I was treated. 
At any rate, over the last 10 years, I have counseled with various people 
of the psychology "profession" and have found most of the people lacking 
In basic respect for their clients, although I kept all appointments 
and was totjdly coherent at all meetings. 

My question regarding this letter is that I would like copies of my 
(in-patient and out-patient) records at the mental hospital, but 
don't know how to obtain them. I have called two hospitals here 
in this geographic area, although I was not hospitalized here, but 
called to get some basic information on how I would go about 
getting permanent and. complete copies of my files. Both times I was 
treated very rudely and told that I would probably have to go to court. 
My files are in the State of Ohio. Because of the geographic distance 
involved, I feel 1 will be taken advantage of by the profession. 

Should I cjJl the American Civil Liberties Union and have them to go 
court for me, or should I hire someone to obtain them for me? I have 
been told that while the information belongs to the hospital, the 
information IN the files is MINE and I have a legal right to them. 
However, I can't get a final answer because of conflicting answers. 

My main reason for wanting my file is because of my fear of future 
discrimination in hiring, etc., and fear that my constitutional right 
of privacy will be invaded. I think I have a right to know what is my 
my files, I'm not concerned with files outside the State of Ohio, but 
am concerned with those files in the State of Ohio. I have another 
question and that is, who has legal access to those files and is it 
required that when someone demands and obtains access to them, do'-i^v 
have the right to know who that person was, what date, and for what 
purpose they alleged they needed the file? Do I have the right to 
know who has seen my files in the past? 



279 



I am also very bitter over the fact that when I ajjply for Jobs, etc., 
I must always have a fear that I will be asked questions such as above, 
which I honestly feel Is noone's business. I run the risk of not 
being hired If I an stupid enough to tell the truth, and I run the 
risk of being fired If hired and later someone finds out the truth. — 
I run the risk of being chronically unemployed for the rest of 
my life under circumstances beyond my control if I apply with 
certain entitles. Perhaps you could tell me how to handle the 
problem in the future. 

I feel strongly that you have a responsibility to demand legislation 
insisting that employers^nSl'ask such questions, just as gays may not 
be discriminated against in some places. Furthermore, I don't feel that 
the medical profession has done much of anything to help people in my 
situation and I would like to see a complete reversal in this profession's 
attitude and would like laws initiated as soon as possible to elevlate 
discrimination. 

A self -addressed stamped envelope is enclosed for your convenience 
because I would -like confidentiality in dealing with your organization. 
I would like to hear from you within 30 days. Thank you. 



280 



National Comnlsslon on Confidentiality of Health Records 
1211 Connecticut Ave, KW 
Washington, DC 20036 



Gentlemen: 

I recently read of your commlBsion In an "Ann Landers" column In our local 
newspaper, and thought perhaps you might be able to give me some help or 
advice regarding a problem that I am having concerning my family's medical 
records. 

In my work I have transferred several times and lived In a number of places 
around the country. Each time our doctors have transferred our medical records 
to our new doctor so that our medical records have been kept complete and up 
to date. The problem Is that our last doctor refuses to send these records 
on to our present family doctor here In Omaha. VRiat, If anything, can be done 
about this? I can see little or no value in his keeping these records. If 
anything) it could be detrimental to my family's present health care, as he is 
holding all of our previous records from all of our previous doctors, dating 
back as far as I960. 

I would appreciate hearing from you soon to see what can be done about this. 
SXfgerelys . ^ ,. / 

I ■• 

.1 



281 



Dear Sir; 

I am interested in what your commission 
intends to do about treatment for alcoholism. 
Recently, my driver's license renewal was held 
up simply because the state had obtained access 
to my health records via an insurance compciny's 
investigation. 

Are you able to forecast the possibility 
of any health information being "privileged" 
when control of it leaves the original 
possessor's domain for some other than the 
original release purpose? 

As a member of the U.S. Air Force, I 
understand that some things are better exposed 
than hidden; however, it seems like there 
is a lot of "McCarthy-like" v/itch hunting 
going on for no other purpose than to hurt 
the individual. 

I would be interested in reading any 
material available on the protection of this 
area of personal privacy. 

Thank you for your consideration. This 
letter is a direct result of your recent 
letter to Ann Landers. 

Sincerely. 



282 



Li*>iTeo To 

^L MCDICINS 



BERNARD l_ ALBERT. M.D., P.C. 

ISO WHITE PLAINS ROAD 

TARRYTOWN. NEW YORK I OSS I 

1914) 332-O090 



August 4, 1977 



Office of the President 

Home Life Insurance Company 

253 Broadway ' .. 

New York, New York 

Gentlemen: 

This letter is written to advise you that an "agency employed by the Home Lif 
Insurance Company to collect and transmit ... information" has been acting in 
a way which embarrasses the Home Life Insurance Company. 

For 13 years I had been in the full time private practice of internal medicine 
in New York City. Almost a year ago I moved my office to Westchester County. 
I still hold a lease on my former office in New York City which is sub-leased 
to tv.'o groups of physicians. I visit that office at least once a week and 
occasionally see patients there by appointment. All records of patients 1 had 
seen in that office are retained in that office. That office incidentally is 
registered as a second office with the Bureau of Professional Licensing Services 
of the New York State Department of Education. I am still listed in the Bronx 
telephone directories but at my Westchester County address. I am a member of 
the Medical Society of the State of New York; I was a member of the Bronx County 
Medical Society but transferred my county society membership to the Westchester 
County Medical Society when I moved my office. The sub-tenants of this office 
hold all mail addressed to me and give it to me when I visit that office. 

During the entire month of June I was told that numerous telephone calls were 
received at that office from a woman who v/anted to speak to me but who would not 
giv^ her name or address or telephone number nui or statetil^her business and who 
always hung up before she could be given my current office telephone number. On 
a Friday afternoon towards the end of June I was in my former office when the 
receptionist for one of the physicians who now uses that office answered the 
telephone and told me that the same woman who had called so frequently was now» 
on the telephone. I spoke to her and was told by her that she represented Equifax 
and asked me to relate over tlie tel ephoi^g all confidential medical information in 
my possession regarding ^^ 1 . she refused to tell me why she wanted 

this information or who she represented but instead said that she had an authorizatior 



283 



BERNARD L ALBERT. M.D.. P.C 



Office of the President 
Home Life Insurance Company 
253 Broadway 
New York, New York 

Page (2) , 

August 4, 1977 



for release of this information and demanded that I give her this information. 
I refused to do so but suggested that she send the authorization to my current 
office address. In the next week I was, for lack of a better word, harrassed 
by this person who finally did state that she represented the Home Life Insurance 
Company. It reached a point that I contacted the Office of the Medical Director 
of the Home Life Insurance Company and was told I was acting properly in refusing 
to give confidential medical information over the telephone to a person I did not 
know without any authorization whatsoever from the patient. Then and only then 
did somebody personally bring to my office a photocopy of the "authorization and 
acknowledgement" signed by the patient. Once I received this authorization I 
then, when I v/as next at my former office, pulled the records and wrote out the 
"Underwriting Medical History Report - Privileged File". As Inquiry was made 
about laboratory findings, rather than re-write probably illegibly the information, 
I left the "Report" with the laboratory reports from my file for photocopying 
where they were misplaced and apparently lost. For several days in their absence 
I received increasingly frequent and more anxious telephone calls from supervisors 
at Eouifax demanding that I turn this report over. Each time they indicated the 
HorneLife Insurance Company was going to take action such as refusing the policy 
and blaming the refusa l^ on me. Fina lly one supervisor asked me if I had ever 
actually attended i5iiiSi^and_jt:£auesjffor any illness and when I said that I had 
seen him only once for a check-up and found him to be in good health, he suggested 
that if I had stated this when I was first contacted, Equifax could have completed 
its report and all this fuss would have been avoided. If I had only given this 
information to an unknovm person without authorization, then it would have been 
easier. 

EquaVax personnel emphasized each ti;r,e they called how important it was that the 
information be promptly obtained yet they wasted one month before locating me. 
I would think that an organization such as Equifax. which claims to be a 
"professional" in this business, would know that physicians do move. One of the 
'supervisors told me that they -have instructions from the Home Life Insurance 



284 






V- BERNAHO-L ALBERT- M.D.;P.C' 



->"'r-'- ■r.-'' 



Office of the- IVesl5ent;>VC;j-rfig>^?^ 
j.-HoR&vLifeJESuirdftce-'C^mpar^^ 




r£i^ugustr*5i3^2>^%j-e^^ 






Company to contact a^'Dr. Albert of 1939 Grand Concourse, The Bronx, New York". 
He never Inquired tiwi this doctor might have moved. Ke was unaware that he 
could obtain a current address of a physician by contacting either the Bronx 
County Medical Society or the Medical Society of the State of New York or the 
Division of Professional Licensing Services of the Departriient of Education of 
the State of New York. He never thought that if he was looking for a Dr. Albert 
and there v/as no Dr. Albert in the Bronx but a Dr. Albert 1n Tar rytown listed 
in the Bronx telephone directory,he should call the Dr. Albert in Tarrytown to 
find out if he was the Dr. Albert in the Bronx. He was simply following his 
instructions from the Home Life Insurance Company to immediately get this 
information. In trying to "innmediately" get this information, there^was a six 
week delay, much harrassment and anno/^ance, and use of v;hat I feelXan undesirable 
and I believe illegal approach in demanding that confidential medical information 
be given over the telephone without authorization. 

I again suggest ' that you discuss this matter with your-iat£i£e=fifcyie Medical 
Director who received telephone calls from me and whose secretary was actually 
asked to call up Equifax and request that they cease and desist from demanding 
medical confidential information without providing authorization in the name 
of the Home Life Insurance Company. ' - - .. :..■ • -.-— 



i - 

The final promise made by the supervisor of Equifax was that he was going to open 
a file on me with the inference that my non-cooperation will now be part of my 
credit record. I believe that iSg a matter of fairness, I should find out what 
if any action has been taken. Yes, a file should be opened but the file should 
state that I will not give out medical confidential information unless and until 
I have received an authorization from the patient to do so. It should also state 
that I desire not to be called and asked to violate a patient's confidence. 

I also strongly suggest that you consider v/hether the conduct of Equifax is 
compatible with the image of the Home Life Insurance Company and whether they are 
really doing their job. For example, on July 18, 1977 the Allstate Insurance 
Company mailed a request for a medical report to my former office address with 
of course an authorization enclosed. This was picked up by me on July 22, 1977. 



6^wl/) 






285 



BERNARD L ALBERT. M.O.. P.C 



Office of the President •■ 

Home Life Insurance Company . '! . 
253 Broadway V. 

New York, New York "■ .■'^: 

Page (4) ' ... ;?■ 

August 4, 1977 • : •; .vk 

I presumed that they received it on July 25, 1977, a week after It was requested. 
This report was received more promptly and at considerably less expense and v;as 
more accurate than any report obtained by telephone solicitation. 

Also be aware that initially the people from Equj'fax refused to identify the 
organization requesting their services. The supervisors stated they were Home 
Life Insurance Company employees and did not identify their actual employer. 

Thank you for your kind attention to this letter. 

Sincerely, 



BL/\:jf. Bernard L'. Albert, H.D., P.C. 



286 



July 6, 1977 

National Commission on Confidentiality of Health Records, Inc. 
1211 Connecticut Avenue, N.W., Suite 5M 
Washington, D.C. 20036 

Gentlemen! 

With regard to your quest for personal accounts, I have two: 

Many corporations offer as a health benefit, a basic Blue Cross- Blue Shield 
plan and an additional major medical plan from another carrier. According 
to the personnel department, the department will offer its services as 
an intermediary in helping the employee obtain benefits from the major 
medical carrier. The services offered amount to the emp loyee giving the 
personnel de£artinent_Jthe completelyfill ed out claim form contain ing 
information from the patTenF'and'The physician, and the personnel department 
wD.1 then send the claim form to the major medical insurance carrier. 
In fact, this "service" is mandatory: the insurance carrier will only 
accpet the claim form through the personnel department. This puts the 
claimant in the difficult position of having his own personnel department 
easily able to gather information on its own employee"s health with 
its possible implications for invagion of privacy as well as implications 
with regard to future employability . One member of my family declined 
to apply for benefits and assumed the total oosts of an otherwise 
covered illness rather than disclose to the personnel department 
a condition which might reflect upon job status. 

This is not an isolated instance. I was formerly a government employee 
whose main office was three hundred miles away. Local, physicians 
did not accept the Blue Cross-Blue Shield Plan from my main offiqe, 
since they were unfaniliar with the form. Ky only recourse was to 
pay for my operation and submit the claim tomy supervisor at work, 
through the mail (and through a secretary). My supervisor then 
submitted the claim to the personnel department who further processed 
the claim and submitted it to Blue Cross-Blue Shield. This enabled 
immediate co-workers, as well as others, _to be_aware of my vasectomy. 

Fortunately for me, I am "not ashamed of it (see? I even put in in 
this letter). However, my supervisor was decidedly against the operation 
from HIS religious point of view and this KBtrt could certainly have 
been a severe impediment for other co-workers of the same religious faith 

as my supervisor to have such an operation performed under similar 
circumstances. 

I am aware of other situations not In my family due to an interesting fact: 
I am a regime registered pharmacist, although I do not practice pharmacy 
actively, but work in industry. Since my co-workers are aware of my 
profession and thus my alleged knowledge, I have had a number of 
confidences bestowed upon m?. There are countless numbers of people, of 
whom I am personally aware, who have high blood pressure, mental 
conditions, and various physical conditions, who must (or feel they 
must) pay for conditions out of their own pocket, which conditions are 
covered py medical plans. However the fear of personnel using the 
information which they obtain through handling of major medical claims 
forms is a severe impediment to making claims, further, the need to 



287 



pay for services bhxicbk personally, rather than receive reimbursement, 
has caused some indi7idudls to delay treatment for servous conditions 
when, in fact, the very establishment of medical insurance is designed 
to allow individuals to seek care that they cannot afford. 

This history has resulted in another interesting situation. I have 
recently accepted a new position with a new emplouer. I chose my 
health beneifts,not on the merit of the benefit, but decided which 
pakcage of benefits would allow my family and myself the greatest 
prvacy with regard to my personnel department. I did, fortunately, 
find a benefit package which would afford me complete coverage and 
prvacy, but did also reject other packages which may have served 
me better solely because of the necessity to have divulged my 
health care needs to the personnel department. 

"There oughta be a law". 

Just a brief statement in xxkx an area not of direct conoernt to youj 
There is now talk of prepaid LEGAL insurance. How would YOU like to 
divulge to your supervisor that you have been arrested and need your 
prepaid ilaim form in order to obtain proper counsel? 

Sincerely, ^ 



288 

September 10, 1976 



Robert L. Robinson, Executive Dlrecotor 
National CoramiBslon on the Confidentiality 

of Health Records 
1700 18th Street, N.W. 
Washington, D.C. 20009 

Dear Mr. Robinson: 

Quite sometime ago, I read in one of our daily newspapers 
that your agency wanted to hear from former hospital 
patients who felt their medical records were shared with 
non-medical personnel against their wishes or without 
permission. 

In a complete psychiatric report pertaining 

to my voluntary hospitalization at 

Hosoital. , Illinois, was released to a 

the Dominican Sisters, Nashville, 
Tennessee. This was done without any consent on my part. 
I had applied to this Roman Catholic Sisterhood for entrance. 

I was hospitalized at Little Company from 

for treatment of depresaaou. 

I had always been under the impression that such records were 
confidential. If I had known what was to follow, I would 
never have sought treatment. I can well understand why many 
people do not seek help for such problems. It is a disgrace 
that such records are open to any Tom, Dick or Harry for 
perusal. 

If a simple Mother Superior can obtain such records without 
batti;ig an eye, what chance does a person have with a large 
Corporation when seeking employment? 

Very truly vours. a . 



289 



DiCeise, Cope ancfOoen 

Attorneys at Law 
Suite 1800. Traders National Bank Building 
1 125 Grand Avenue 
Kansas City. Missouri 64106 
(816)221-6420 
Clyde G, Meise James R. Cope 

W. Edward Ccen. Jr. Harl T, Hanson 

Robert 0. Jester April 24. 1978 

Mark A. Thornhill ^ 



National ComnLssion on Confidentiality 
of Health Records 
1211 Coimeticut Avenvie, N.W. 
WashlngtOTi, D.C. 20036 

Gentlemen : 

It is n^r understanding that you are involved with studies in regard 
to the ccsifidentiality of individual health related records. I 
was recently contacted by a young lady in the Kansas City area who 
was extrenely tpset as a result of an experience she had with a local 
hospital and an LPN on its staff. This young lady was admitted to 
a unit in that hospital as a result of severe emotional depression 
whidi she was suffering. In the course of the hospitalization an 
LPN on the staff of the hospital gave all of the details of this 
young lacfy' s adnrLssioi to the facility to her roommate who happended 
to work at the same place as the patient and when the patient was 
released frcm the facility and returned to work she was iranediately 
confronted with runrors , stares and other accusations which completely 
nullified any assistance she had attained viiile a patient in the local 
hospital . 

This in ny opinion is a truely imfortunate act on the behalf of this 
rather careless licensed practical nurse. I would like to be in a 
posititxi to explain to this young lady what rights of confidentiality 
she has when a patient in a hospital and undergoing treatment for 
an enntional disorder. If you do provide the guidelines of confi totialitxi 
for the American Hospital Associatim, Ar grican Fsychiatxic Ai^soc iation 
and any Association which might represent licensed practical nurses 
I would certainly appreciate receiving that intorntHcion. 



Yoxjr consideration and cooperation willja e m rrt ? ±han appreciated 



PDJ:jw 




290 



CoA^^.'c/cMfi'<j./,--^y o-f //ea/^A (Records 
12.11 CoNNe<^^!cu^ Aue^ue, ^ s/. W. 

X «aM \A{rC-i-tfja "f-o you bccAusG X i-txit^k. 37 fJced 
help W('-f-h d€-fej-(^ri^rtjj Whai- 't^^ore^Ahcoi^ iV Tm My 
hCAl-i-h records. 1^ ^SvAC bee i^ t^osHy hoNes-h viCi-l^ 
etc^ployers .•^/ ^^U'^3 o^i- •tUe.^r AppUcsi-.'ot^s -for- 
^[plly^ec^f ^^crf r Ka.c ^.^veN +he^ pofrN-f-c^Wy 

£)e.Wj hospri^<ilr2e<i -for ci wen/oas /;rrd fc c{ow/m . 

X c/«Va^ec/ fA'^^-s citiMa^rM^ tt^-forcci^l-i'-oN duri^t^^ 
d pWsStCA^ eJcd»/l«*N df for^. X <^e^ u}orried +t\A+ 
•J-Ui*-5 fesi -^or-tvi A-f I'^OM rfley fc>e Sfored iM a ce«^+rcif 
d^fa bdMji Where CMployers ^eNcrAUy Mae 
<acce5? -fo /4-. /-/o"> cdrsf X ■fi't-jJ ou"^ r'^ X aro 
6er^Nj /Ju^-^ ^y -^^'^^ /'N-A,ronafroN f 



291 



I/n /^or-f aM<i+e fy ^ +Ke s+^+e- o"^ Texas ^sks hluKS+ly 
hd^^c e»/er Ka.d a \ief-i^ous 6r<?«jfc c/otuM . Mos+ 

Ct^ ploy i^erJ'f' -foi-t^S. 

VoM CdM ^eo i-^Kii- X ^t^ <a prtsoN^r o-f 

you <:«ifs^ <?/^e <^e. <^£>ou.f fKr^ Afld.+ -fe/- w/Cl 
be ^jrcife Axil y acAivow fe<^^e<f . 

S't*NCere/y yours 



292 



/^// defined^ ieiU >^0£*iue, M U/. 

-jrnPduJ your /etter -iodiu^ ^ -^'^ /Jin/ers ^ 

\ IttttJz bn.'i ^A€{v7^Aif/Ic^^ sqJ ^*'d ^^^ prth^e/^CLf 
nhfr^e. //our /e^r UM Me HcJ^li^ (!dr^€. -ii^^, 
^di'dnoi /<nou> uf^ere ^ df'reoJ: mj/ (!j>m/^/iU^C 

Tus^tl "^ /idLOe ZL rar)ln.6iuj dacXcr- henz cry 

SCnae jone ti CLnC^p- tbujn z^ o/3Crt hisccon /^^itiz. 

^hiu/e hdkJ /ham truiuA/es. 

[xxhjJJ nci rekcii>'€ tAt^n -to me, If^^^e^^ en cnJc^ 



293 



I 
Tk^Tki ^cuod •6A^ Ld&re uji^i>\ ^^ /£huJ. 

XTi '^ €2^ hoc/y suncf ^^ one ^houJd A^^e tl4e 






294 



iff (hifij2iic -^^^ ^^'^^ ^^ kji's/^LOy^ tcnQernfi^ 
tire dJr^^y proic(Lie.<i, ie.^ *'/=reec/orn £f/^ :xh/^crrr^k 

ihUf^K y^ ^^ ^ue/^ Per jj$icr ^fY\e tlnj 



r 



295 









<:>L^^t^'^,^^ <?K^ ^^-^^-^ ^A-<^ 



296 












297 



,^^l;t,A-X.A.WLX(.-yvt_^ 





^ 



^-^-£.-'1^-^ — *»— -(w-c— «^_, ,^rit — r /p 




\j2 



Ct^-^JO^^ ..^nSlyL.^<tji_^ ^^/-if^^^^-J ./^^ ' 




298 








> t^j<i_ 







in^ 




. /W p^,,^ p^^ /^ y^u^.-y'^J^ 4^ . 





299 




© 












300 



^ . ^Sa-^ f.^*-^^^^ t^lU ^~P-^ J^'" ' ' 



dA^iOx...^ . ^^r-o^ 7?./>^.4.0L %Aii^lU a "^^^-^ >Lli'xA^A.. 




OlAJ. lXw ^::iiL 9^_e^^~X>*— yq :tLL.LJx^ Ckx_^ 

' /!MjLcLala^' /^t^/c^/X AtUi^. (^i^^JyrJ- 







\ ■ 
■.i 



301 



Medicaid Audit: Crisis in Confidentiality and the 
Patient-Psychiatrist Relationship 

BY HARVEY J. SHWED, M.D., SEYMOUR F. KUVIN, M.D.. AND RAVI K. BALIGA, M.D. 



The authors describe their experience with a routine 
Medicaid audit and discuss the damage such a 
procedure can do to the trust between psychiatrists 
and patients, confidentiality, doctors' reputations, 
transference reactions, and patients' own emotional 
slates. The authors point out that these crucial issues 
have broad implications because of the possibility of 
passage of national health insurance legislation. 



Confidentiality is undergoing intensive scrutiny 
because of the major upheaval in traditional concepts 
of the patient-doctor relationship in the past decade 
(1-3). Third-party insurers, whether private or govern- 
ment, armed with computers and data banks, have 
seemingly insatiable appetites for detailed information 
about what transpires between doctor and patient in 
order, they say, to justify the benefits they pay and to 
be assured that competent medical service has been 
rendered (4-9). What are the boundaries between the 



Received Ocl. 4. 1977; accepted Jan. 9, 1978. 

Drs. Shwed and Kuvin are Co-Direc(ors. and Dr. Baliga is on the 
Jtaff. Psychiairic Inslilulc. Saini Michaefs Medical Center. 268 
High St.. Newark. N.J. 07102. Drs. Shwed and Kuvin are also Clini- 
cal Assistant Professors, and Dr. Baliga is Clinical Instructor. De- 
partment of Psychiatry. New Jersey Medical School of the College 
of Medicine and Dentistry of New Jersey. Send reprint requests to 
Dr. Shwed. 



right to know and the doctor's time-honored pledge to 
patients of confidentiality? 

Nowhere is confidentiality more basic to a discipline 
than in psychiatry and psychotherapy. Our experience 
suggests the possibilities for destruction of this pa- 
tient-psychiatrist trust in a routine Medicaid audit of a 
psychiatrist's practice. (Medicaid is the federal-state 
program that pays for the health care of 28 million low- 
income Americans who meet eligibility guidelines for 
participation.) 



MEDICAID AUDIT PROCEDURE 

In New Jersey, a Medicaid audit is an investigation 
of a physician and his or her practice. It is for the most 
part a routine check of doctors who treat significant 
numbers of Medicaid-sponsored patients. Medicaid 
stafif limitations prevent the staff froth scrutinizing all 
doctors who see Medicaid patients. They therefore 
give priority attention to doctors who see a large num- 
ber of Medicaid patients or whose practice has raised 
the suspicion of fraud or abuse. We were audited be- 
cause Medicaid patients comprise approximately 10%- 
15% of our private group psychiatric practice, which is 
located in a medical school-affiliated teaching hospital 
in Newark, N.J. 

The Medicaid audit as typified by our experience in- 
cludes the following: 

1. The psychiatrist's office is informed of the im- 
pending audit and a mutually convenient appointment 



0002-953X/79/(M/0447/04/$00.45 © 1979 American Psychiatric Association 



447 



302 



MEDICAID AUDIT 



Am J Psychiatry I36:4A. April 1979 



is made. The doctor is lold ihat 25 or 30 patient charts 
wil! be reviewed the day of the audit and that pre- 
selected patients will also be interviewed by the audit 
team either before or alter the formal visit to the psy- 
chiatrist's office. The identity of the patients is not re- 
vealed until the day of the audit. Members of the audit 
learn who interview physicians in the field are usually 
not physicians. 

2. The team interviews the psychiatrists and asks 
about such items as Board certification or eligibility, 
medical school affiliations, and names of other physi- 
cians and staff members within the practice. 

3. The team asks for the charts of the preselected 
patients. 

4. The team views and reproduces the charts. This 
procedure is especially important to them because a 
Medicaid physician at the central office ultimately re- 
views these patient records. In cases where a doctor is 
suspected of fraud or abuse, such charts and records 
serve as evidence for the Attorney General's office. 

5. The team also reviews office bookkeeping proce- 
dures. Because New Jersey Medicaid will not reim- 
burse psychiatrists for unkept appointments, the audit 
team searches for deviations from this standard when 
examining a psychiatrist's records. The audit team 
asks to examine the doctor's appointment books, pre- 
sumably to assess the time the psychiatrist devotes to 
each patient. 

6. "The auditors, according to what our patients have 
lold us, ask questions relating to a) quality of care pa- 
tients feel they have received, b) how they like their 
doctor, c) how much time the psychiatrist spends with 
them, d) whether they were "prepped" for the inter- 
view by their doctor, and e) if Ihey have any com- 
plaints about the doctor or his or her practice. 

7. The team collects any information doctors offer as 
documentation of the kind of service rendered to their 
Medicaid patients. We supplied to the audit team cop- 
ies of an introductory and orientation brochure we 
give each new Medicaid patient. The 'brochure ex- 
plains our practice policies, provides emergency num- 
bers to call when our office is closed, and indicates our 
"on call" availability. It also attempts to deal with the 
issue of r.nkept appointments, a serious problem in a 
psychiatric practice and, unfortunately, a character- 
istic pattern for many Medicaid-sponsored patients. 
We also supplied our weekly statistics of unkept Med- 
icaid appointments to the audit team. 

To document our contention that Medicaid patients 
receive extraordinary amounts of extra session service 
and lime, we asked every member of our staff to keep 
a log for one month of the time and effort devoted to 
our Medicaid patients other than face-to-face psycho- 
therapy sessions. 



THE PSYCHIATRIST-PATIENI TRUST 

It is difficult for us to conceive of meaningful psy- 
chotherapy taking place without implicit and explicit 



guarantees to the patient that confidentiality will be 
maintained (10, II). Under the best of circumstances, 
patients enter psychotherapy with varying degrees of 
suspiciousness, resistance, and mistrust, based on 
their earlier life experiences. 

Guarantees of confidentiality are crucial to the spe- 
cial trust between patient and psychiatrist that permits 
the patient to share increasingly intimate and difficult 
material with the therapist. For the overly sensitive or 
frankly paranoid patient any hint that confidentiality 
has been violated will destroy the therapeutic endeav- 
or. So fragile and yet important to psychotherapy is 
the concept of confidentiality that, in our opinion, 
merely the idea that someone might have access to in- 
timate material precludes meaningful psychotherapy 
from taking place. 

On the first day of contact with the psychiatrist, the 
Medicaid patient signs a form permitting the psychia- 
trist to receive reimbursement for his or her services, 
which also gives Medicaid permission to examine and 
request any and all charts. 

Patient Certification. Authorization to release informa- 
tion, and payment request. I certify that the service(s) 
covered by this claim has been received, and I request 
ihai payment be made on my behalf. I authorize any hold- 
er of medical or other information about me to release to 
the Division of Medical Assistance and Health Services or 
its authorized agents any information needed for this or a 
related claim. 

It is our belief that the nature of the Medicaid form 
brings greater pressure to bear on the Medicaid patient 
than on other patients. Middle-class patients do not 
have to sign such a form, and, in fact, many of them 
decide not to sign any insurance form because of the 
issue of confidentiality. Regrettably, they end up pay- 
ing for psychotherapy on their own. 

Medicaid's "Right to Know" 

In New Jersey, 600,000 residents receive Medicaid 
funds, and the slate and federal governments spent 
$429,577,145 for their health care in 1976. Across the 
nation, 28 million Americans depend on Medicaid for 
their health care, at a total cost of $14.7 billion. A pro- 
gram encompassing so many people and such large 
sums of public money may justly argue that it has not 
only a right but a responsibility to American citizens to 
monitor the medical care that they pay for. The execu- 
tive and legislative branches of government expect it 
and the general public, whose tax dollars pay for the 
program, demands it. 

Violations of Confidentiality 

The act of reading psychiatric patient records by the 
staEf of a geographically distant bureaucratic agency 
makes a sham of any pretense of confidentiality be- 
tween a psychiatrist and his or her Medicaid patients. 
The Medicaid team who conducted our audit were not 
physicians. They were polite, deferential, and tactful 



448 



303 



I Am J Psychiatry 136:4A. April 1979 



SHWEO, KUVIN, AND BALrCA 



as they went about their business; nevertheless we 
shared a deep feeling of having been violated and hav- 
ing in turn betrayed our Medicaid patients. 

Our sense of outrage was intensified by the knowl- 
edge that the selected patient charts were to be copied 
and transferred to central Medicaid offices in Trenton 
where they would be reviewed by the "psychiatric 
consultant." What would ultimately happen to these 
copies of our patient records was not made clear. 

Medicaid's own policy of guaranteeing confidentiali- 
ty and promising serious penalties to any stafFmember 
found guilty of violating such confidentiality is in- 
adequate for the psychiatrist and his or her patient. In 
our opinion, merely the act of sharing psychiatric ma- 
terial with "benign" stiangers is detrimental to the pa- 
tient-doctor relationship. 

In addition to the symbolic impact that Medicaid's 
"right to know" has upon the therapeutic alliance, 
there are more realistic and practical issues. We are 
less concerned with nefarious deeds perpetrated by 
"Big Brother" governmental agencies (although the 
Watergate-related Daniel Ellsberg case comes to 
mind) than with the inadvertent foul-ups that seem 
likely to occur when any large bureaucratic organiza- 
tion has confidential data at its disposal. The recent 
disclosure that names of 48.000 New York State wom- 
en who had undergone abortions had not been deleted 
from data transmitted to the National Institutes of 
Health for a research project is a case in point (12). 



PATIENT-PSYCHIATRIST RELATIONSHIPS 
Psychiatrist and Staff Anxieties 

An audit or examination, no matter how routine and 
from whatever the source, evokes anxiety ,in the psy- 
chiatrist and his or her stafiF. In an age of increasing 
government involvement (e.g., potential national 
health insurance, PSROs, and mental health advo- 
cacy), psychiatrists and their physician colleagues 
should be prepared for the onslaught of those carrying 
"right to know" passes. 

The nightmare of every ethical physician Is that a 
government investigating team, which consciously or 
unconsciously must justify its existence, will be too 
rigid and literal in interpreting rules or regulations and 
will fault doctors for not "dotting their i's or crossing 
their t's." In the case where an investigation leads to 
an actual indictment, ultimate acquittal is little con- 
solation to the doctor who in the meantime has suf- 
fered irreparable damage to his or her professional rep- 
utation, days and months of emotional stress, and in- 
come lost from his practice and from legal fees. 

The Effect of Patient Interviews 

One of the charges leveled against a doctor in our 
state who was ultimately indicted for Medicaid abuse 
was that he attempted to "prep" his patients for their 
interview with the team. The Medicaid team, naive 



about psychotherapy issues and techniques, might 
therefore view any pre-interview discussions with our 
patients as an attempt to influence the patient's honest 
and frank responses to their questions, so when we 
were informed of the Medicaid audit, we felt con-, 
strained not to discuss it with our Medicaid patients. 
This violates a basic tenet of psychotherapy: that any- 
thing and everything relevant to the patient's psycho- 
therapy can and should be discussed. 

One psychiatrist, not in our group, told us that after 
a Medicaid audit interview patients called to warn the 
therapist that he was "in trouble." No matter how be- 
nign the investigation may be or how nonpejoratively 
it may be presented to the patient, the therapeutic rela- 
tionship has been injured and, by innuendo, the psy- 
chiatrist's reputation has been harmed. 

Furthermore, the type, intensity, and stage of trans- 
ference reactions between the patient and psychiatrist 
may be interfered with by the audit interview. Like- 
wise, transference may significantly distort the pa- 
tient's replies to the investigator's questions; patients' 
responses may be unrealistically glowing and warm 
when positive or even erotic transference is occurring 
and unfairiy damaging if the patient is working through 
issues of negative transference at the time of the audit. 

The selection of patients who will be interviewed by 
the audit team docs not, to our knowledge, consider 
the patient's psychological ability to take part in the 
interview or how the dialogue might be emotionally 
harmful to the patient. What is the effect of the audit 
interview on the patient who is fragile and overiy anx- 
ious, paranoid, withdrawn, reclusive, passive-aggres- 
sive, or sociopathic? How do these characteristics in- 
fluence and distort the replies that are given, especially 
to a nonmedical, nonpsychiatric investigator? What is 
the ultimate effect on the nature and future of the ther- 
apy and the patient-psychiatrist relationship? 



COMMENT 

As America moves closer to a national health insur- 
ance program, health planners, politicians, and gov- 
ernment officials are gaining experience fi-om the cur- 
rent health payment program for the 28 million Medi- 
caid-sponsored citizens in the United States. The 
majority of psychiatrists in private practice who do not 
see Medicaid patients will face similar issues if and 
when they are blanketed into a national health insur- 
ance program serving a more universal population. 

The overriding philosophical issue, with many di- 
verse practical ramifications, is whether a govern- 
ment-administered health program, which spends 
large sums of public tax money and insists that it has 
the right to know in order to monitor quality of care 
and insure fiscal integrity, can accommodate the need 
to maintain a meaningful patient-psychiatrist relation- 
ship and confidentiality. 

The task of dealing with and reconciling these con- 
flicting tieeds is awesome. 



449 



304 



MEDICAID AUDIT 



Am J Psychiatry I36.-4A. April 1979 



REFERENCES 



1. American Psychiatric Association: Position statement on con- 
fidentiality and privilege with special reference to psychiatric 
patients. Am J Psychiatry 124:1013-1016, 1968 

2. American Psychiatric Association: Position statement on the 
need for preserving conildentiality of medical records in any na- 
tional health care system. Am J Psychiatry 128:1349. 1972 

3. Gurevitz H: Tarasoff: protective privilege versus public peril. 
Am J Psychiatry 134:289-292. 1977 

4. Noll JO. Hanton MJ: Patient privacy and confidentiality at men- 
tal health centers. Am J Psychiatry 133:1286-1289, 1976 

5. Wcstin AF: Computers, Health Records, and Citizen Rights. 
Monograph 157. Washington, DC, US Department of Com- 
merce, National Bureau of Standards, 1976 



6. Grossman M: Insurance reports » a threat to confideniialiiy. 
Am J Psychiatry 128:64-68. 1971 

7. Bush V: New data battle: stale's need to know vs. patient's pri- 
vacy. Mod Health Care 3:60-61, 1975 

8. Baldwin JA, LeffJ. Wing JK: Confidentiality of psychiatnc data 
in medical information systems. Br J Psychiatry 128:417-427, 
1976 

9. Schuchman H: Editorial: on confidentiality of health records. 
Am J Orthopsychiatry 45:732-733, 1975 

10. Dubcy J: Confidentiality as a req>j>rement of the therapist: tech- 
nical necessities for absolute privilege in psychotherapy. Am J 
Psychiatry 131:1093-10%, 1974 

11. Closson WG Jr. Hall RA. Mason BS: Confidentiality in psychia- 
try and psychotherapy. California Medicine 113:12-15, 1970 

12. Abortion study with names. New York Times, May 15, 1977, 
section 4 



[Whereupon, at 1:55 p.m., the subcommittee adjourned, to recon- 
vene at 10 a.m., Monday, April 9, 1979.] 



/ 

/ 



PRIVACY OF MEDICAL RECORDS 



MONDAY, APRIL 9, 1979 

House of Representatives, 

Government Information 
AND Individual Rights Subcommittee 
of the Committee on Government Operations, 

Washington, D.C. 

The subcommittee met, pursuant to recess, at 10:05 a.m., in room 
2203, Rayburn House Office Building, Hon. Robert F. Drinan 
(acting chairman of the subcommittee) presiding. 

Present: Representatives Robert F. Drinan, Ted Weiss, Thomas 
N. Kindness, M. Caldwell Butler, and John N. Erlenborn. 

Also present: Timothy Ingram, staff director; Robert Gellman, 
professional staff member; Euphon Metzger, secretary; and Thomas 
Morr, minority professional staff, Committee on Government Oper- 
ations. 

Mr. Drinan. The subcommittee will come to order. 

In the absence of the distinguished chairman of the subcommit- 
tee. Congressman Richardsou Preyer, I will preside. 

Last Wednesday this subcdijimittee began hearings on privacy of 
medical records. We began with a presentation of the administra- 
tion's general approach to privacy issues and received a statement 
explaining the medical records provision of the administration's 
proposal. 

The chairman of the National Commission on Confidentiality of 
Health Records also appeared before the subcommittee. 

Today we continue to examine the legislative proposals, H.R. 
2979 and H.R. 3444, both of which would protect the confidentiality 
of medical records. 

Our first witness this morning is Ms. Jane Rogers, director of 
legislative affairs, American Medical Record Association. She is 
accompanied by Ms. Lorraine Volz, Thomas Jefferson Hospital in 
Philadelphia. 

We welcome you both and invite you to proceed with your state- 
ment. 

I will announce the other witnesses now and will come back to 
them. Our second witness will be Dr. Jerome Beigler, chairman of 
the American Psychiatric Association Committee on Confidential- 
ity. , 

Thank you for bringing us your statement on this important 
issue, Dr. Beigler. We will get to you soon. 

Our last witness will be Dr. Leon Cordis, who is representing the 
Society for Epidemiological Research, American Association of 
Medical Colleges. 

(305) 



306 

We are very happy to have you here, Ms. Rogers. We have your 
statement. Without objection, it will be made part of the record. 
You may proceed in the way that you desire. 

STATEMENT OF JANE ROGERS, DIRECTOR OF LEGISLATIVE 
AFFAIRS, AMERICAN MEDICAL RECORD ASSOCIATION; AC- 
COMPANIED BY LORRAINE VOLZ, DIRECTOR, MEDICAL 
RECORD DEPARTMENT, THOMAS JEFFERSON UNIVERSITY 
HOSPITAL, PHILADELPHIA, PA. 

Ms. Rogers. Thank you very much. 

We would like to submit our written testimony and we will 
summarize this testimony here today. 

I represent the American Medical Record Association, an organi- 
zation representing more than 22,000 registered record administra- 
tors, accredited record technicians, and others interested in medi- 
cal records and health data. The primary purpose of the association 
is to promote comprehensive health record services for the welfare 
of the public. 

I appreciate the opportunity afforded by this subcommittee to 
provide information about confidentiality and medical record prac- 
tices and problems as perceived by the American Medical Record 
Association and profession. 

Historically, the primary purpose of the medical record has been 
the care of the patient — to document the cause of health care and 
to provide a medium of communication among health care profes- 
sionals. 

In recent years, however, our society has seen changes in the 
delivery, payment, and accountability mechanisms of the health 
care system, which have subjected health facilities and medical 
record departments, in particular, to staggering demands for medi- 
cal information. You may now assume that medical records are 
used only for patient care, but just listen to the potential secondary 
users: (1) payers for health services, both private and Government 
insurance plans and programs; (2) public health agencies; (3) medi- 
cal and social researchers; (4) rehabilitation and social welfare 
programs; (5) employers; (6) insurance companies; (7) Government 
agencies; (8) educational institutions; (9) judicial processes; (10) law 
enforcement and investigation; (11) credit investigation agencies; 
and (12) accrediting, licensing, and certifying agencies. 

A typical hospital medical record includes the patient's name, 
address, age, next of kin, and other identifying information. The 
medical history includes the chief complaint; details of present 
illness; past medical, psychiatric, social, and family histories; treat- 
ments, and other sorts of things. 

The physical examination record contains positive and negative 
findings of a comprehensive current physical assessment and a 
preliminary diagnosis. 

The record contains findings of diagnostic tests adminstered, con- 
sultations sought and rendered, all orders for medications and 
treatments, and there is a comprehensive summary written at the 
time of discharge. 

The amount of detail recorded in the medical record may be 
affected by the knowledge on the part of the patient, members of 



307 

the family, or the physician and other health care practitioners 
about possible uses of the record. 

Patients who are aware that the information in the record may 
be available to third party payers, attorneys, employers, life insur- 
ance companies, or others may withhold certain information that 
he believes can be used against him or that he considers to be of 
such a personal nature that its disclosure might be embarrassing. 

Similarly, members of the patient's family may not wish to make 
full disclosure for the same reasons. This situation is of growing 
concern to physicians who fear that the demands for medical infor- 
mation for purposes other than care of the patient has resulted in 
concealment of important information having direct bearing on 
their ability to diagnose and treat the patient. 

Cases of abuse resulting from access to medical records and 
medical information are well documented. Perhaps the best known 
criminal cases are the Ellsberg case and the recent Denver case, in 
which private investigative firms hired by insurance companies 
posed as medical professionals and obtained medical records under 
false pretenses from hospitals. 

Other sample cases of misuse or mishandling of medical informa- 
tion includes transfer of diagnoses from the insurance company to 
patients' employers, transfer of information on a husband or wife 
who has been a patient via the insurance company and/or employ- 
er, linkage of medical with nonmedical computer files in the name 
of research, use of medical information in denying insurance, em- 
ployment, and so on. 

Traditionally, it has not been the practice of health care provid- 
ers or institutions to provide the patient access to the medical 
record itself In the last few years some 14 States have made 
statutory provisions for such access. It has been the practice to give 
verbal information about facts the patient should have or to pro- 
vide certain summary data to the patient, and these practices seem 
likely to increase with the growing recognition of the individual's 
right to know. 

The American Medical Record Association supports the right of 
the patient to have access to his medical record. In an era when 
the medical record is widely reviewed we believe the patient, too, 
deserves this right and that such a right is necessary for the 
patient to be truly informed when he signs an authorization for 
release of the medical record. AMRA's model policy on patient 
access reads: 

Subject only to specific contraindications by the attending physician and to any 
legal constraints such as those governing minors and those adjudicated as incompe- 
tent, a patient may have access to his own health record for review upon written 
request with reasonable notice. A patient may have access to records of his care 
after discharge and completion of the health record. Photocopies of health records 
will be provided on written request by the patient and payment of a reasonable fee. 

The majority of releases of medical records are made only after 
the patient has signed an authorization for release of such informa- 
tion. However, a major problem in the confidentiality question is 
the format and methodology of such authorizations or consents 
signed by the patient. There are three types of consents which pose 
a problem: The blanket consent, the prospective consent, and the 
perpetual consent. 



308 

First, in blanket consent patients or guardians are asked to sign 
releases which allow facilities to disseminate "any and all" identifi- 
able information to whomever is offering a benefit or service to the 
patient. The patient is not himself "informed" as to the full extent 
of the record's content, which segments of it will be open to third 
party access, or what will happen to the information once it is in 
the third party's possession. Blanket consent does not serve to 
instill a sense of responsibility in the collectors, storers, and users 
of patient data. 

Second, difficulty arises from the common third party practice of 
requesting prospective consent, or consent of release of information 
prior to treatment. This means that the patient is consenting to 
the dissemination of that which is not yet collected, a practice 
which precludes any intelligent decisionmaking on the part of the 
patient. 

Third, most insurance companies request a form of consent 
which could be construed as perpetual consent, since there is no 
attendant time limit set for validity of the consent. With other 
requestors, health care institutions vary in the time limits within 
which they accept patient consent as current. In some cases health 
care institutions are adopting more stringent limits, but there is no 
uniformity of policy in this area. 

The most frequent disclosure of medical record information is to 
third party payers: Blue Cross, Blue Shield, commercial insurance 
carriers, and Federal and State Governments, whether directly or 
through fiscal intermediaries, for reimbursement or claims pur- 
poses. 

The amount of information provided is usually determined in 
relation to the purpose and to the scope of authorization. The 
demands of third party payers were, in the past, reasonably limit- 
ed. Increasingly during the past several years, demands for more 
extensive documentation in connection with claims processing have 
expanded to include copies of discharge summaries or, rnore and 
more frequently especially for medicare or medicaid reimburse- 
ment, photocopies of the entire medical record. This presents a 
costly and time-consuming demand, and the extensive disclosure 
involved is disturbing to medical record practitioners in light of 
their ethical responsibilities. 

We believe that the pracice of copying entire medical records for 
review outside hospital premises is a practice largely for the "con- 
venience" of fiscal intermediaries, insurance companies, PSRO's, et 
cetera. AMRA has voiced its opposition to this practice to no avail. 

The American Medical Record Association's position statement 
on confidentiality includes the following model policy on authoriza- 
tions: 

All information contained in the health record is confidential and the release of 
information will be closely controlled. A properly completed and signed authoriza- 
tion is required for release of all health information except: 

A. As required by law; 

B. For release to another health care provider currently involved in the care 
of the patient; 

C. For medical care evaluation; 

D. For research and education. 

In keeping with the tenet of informed consent, a properly completed and signed 
authorization to release patient information shall include at least the following 
data: 



309 

A. Name of institution that is to release the information; 

B. Name of individual or institution that is to receive the information; 

C. Patient's Full name, address, and date of birth; 

D. Purpose or need for information; 

E. Extent or nature of information to be released, including inclusive dates of 
treatment— Note: An authorization specifying "any and all information. . ." 
shall not be honored; 

F. Specific date extent, or condition upon which consent will expire unless 
revoked earlier; 

G. Statement that consent can be revoked but not retroactive to the release of 
information made in good faith; 

H. Date that consent is signed— Note: date of signature must be later than 
the dates of information to be released; 

I. Signature of patient or legal representative. 

This ends the AMRA statement on authorizations. 

We believe that legislation which provides strict provisions for 
authorizations will be a great asset to limiting disclosure of infor- 
mation, especially copying and disseminating entire copies of medi- 
cal records. We caution Congress, however, not to place the sole 
provision for proper authorization in a medical record privacy act. 
Responsibility should also be placed on the insurance and law 
enforcement industries through legislation pertaining to those in- 
dustries. Such responsibility includes the medicare/medicaid and 
other Federal insurance programs as well as private carriers. 

Release of medical records without a signed authorization is 
considered a legitimate practice under several instances: Release to 
health employees and consultants caring for the patient, for health 
research, audits and evaluations, public health and safety, law 
enforcement, judical and administrative proceedings, and per sub- 
pena, summons, or search warrants. 

Any legislation should state explicit circumstances under which 
medical records can be obtained without authorization and should 
provide safeguards to prevent direct or indirect identification of 
patients or further disclosure from those receiving records. 

To meet the demands and needs for information, health care 
facilities and recipients of information have turned to computerized 
systems. 

Infinite storage capacity and linkage ability between computer- 
ized technologies has dealt the greatest blow to confidentiality. 
Massive nationwide data systems are operated by Blue Cross /Blue 
Shield, Medicare, DREW, PSRO's, private insurance carriers, and 
insurance service firms such as the Medical Information Bureau 
and Equifax. These systems not only have the capacity to link data 
but are active in this endeavor. 

Perhaps the most frightening aspect of computerization in health 
today is activity supported by Congress through passage of Public 
Law 95-142, Medicare/Medicaid Antifraud and Abuse Amendments 
of 1977, section 19, and under the jurisdiction of the Department of 
Health, Education, and Welfare's Health Care Financing Adminis- 
tration. 

DHEW will soon issue proposed regulations which call for the 
collection of a uniform hospital discharge data set which involves 
patient and provider identities, diagnoses, and other specific infor- 
mation. The UHDDS will be collected and processed by regional 
processors. Identifiable data will be linked to billing data and 
stored in a national data bank in the DHEW. Data will be distrib- 



310 

uted to PSRO's, HSA's, and other Federal departments. The na- 
tional health computer bank which we were told would never be 
created is here. There is no reason to believe that at some future 
date this health data will not be linked to FBI, CIA, IRS, credit, 
insurance, and other computers. AMRA has voiced strong opposi- 
tion to DHEW plans for data collection and we await proposed 
regulations. 

Any national health insurance program is likely to expand re- 
porting requirements and centralize the information collected in 
data banks. 

Legislation created the authority for current computer activity. 
Any legislation on data security must first put limits on data 
collected and place stringent restrictions on release and linkage. 

The medical record practitioners, health providers, and patients 
are in a serious dilemma over confidentiality. The dilemma of the 
medical record profession centers on how to fulfill the obigations to 
provide needed information to serve the patient, provider, and the 
community while protecting the patient. The dilemma for the 
health provider is confidentiality versus payment for services on a 
timely basis to assure cash flow. The dilemma for the patient is 
confidentiality versus insurance, employment, credit, and other 
services. In reality, the question comes down to confidentiality 
versus money. 

In summary, the American Medical Record Association strongly 
suggests voluntary and legislative efforts: To provide patient access 
to medical records with proper restrictions; to assure the patient 
full knowledge of and control over dissemination of his private 
information through strict authorization for release of information; 
to control redisclosure by secondary recipients and users of medical 
information; and to control linkage of computerized health infoma- 
tion systems. 

In conclusion, I quote from "Computers, Health Records, and 
Citizens Rights," a study conducted under the Institute for Comput- 
er Sciences of the National Bureau of Standards, by Alan Westin: 

As American society redefines and reorganizes its health care system in the 
coming decade, it will have to make increased use of computer technology to 
manage the rivers of data that will be generated. ... If the question is not whether 
but how such technology will be used in health care, American society has one 
nonnegotiable condition for this process. Basic citizen rights cannot be made a 
casualty of technology-assisted health systems. To do so would be to betray the 
tradition of Hippocrates, and ultimately to dehumanize health care itself. 

This ends our summary. 

We would like to thank the subcommittee staff for their assist- 
ance in our preparation of testimony and the questions that we 
gave to the subcommittee. 

Mr. Drinan. Thank you very much for an excellent statement 
and a very comprehensive one. 

Also, I want to commend you and your association upon the 
professional standards which you are disseminating and developing 
for 22,000 registered record administrators. 

You state the case very well in your summary, it seems to me, 
but may I ask just a couple questions? 

Ms. Rogers. Certainly. 



311 

Mr. Drinan. Is it possible that the American Medical Record 
Association, along with everybody else in the health field, could 
develop adequate voluntary efforts in this area so that legislative 
guidelines would not be necessary— at least at the Federal level but 
perhaps with State guidelines? 

Ms. VoLZ. Mr. Drinan, I would be inclined to say that it would be 
better to have them developed at the Federal level because you 
would see such a tremendous variety at the State level. There 
would be no consistency among them. 

Mr. Drinan. I take it you want these Federal guidelines or some 
form of the bill that the chairman of this subcommittee proposed to 
the administration? 

Ms. VoLZ. Yes. That would be very helpful. 

Mr. Drinan. Would you expand just a bit, Ms. Rogers, on what 
you stated on pages 18 and 19? You say there is no reason to 
believe that the health data will not get into the hands of the FBI, 
the CIA, and the IRS. Isn't there some legislative way to prevent 
that from happening? 

Ms. Rogers. I am sure that if this national health data bank is 
created, which we believe it will be, then that perhaps would be 
the only way to prevent a future linkage of the systems. 

I might give you an example. We will present this case for the 
record after the hearing today. There is a State in which there is a 
State law that requires that all abortion cases be submitted to the 
State agency within 48 hours of the abortion. In the name of 
research it has been documented that the names of these patients 
were put into a computer file and that there was cross reference 
between the driver's license and the State tax services. This is a 
very good example of what can happen to medical information that 
is collected for supposedly legitimate reasons and how it can get 
into the computer linkage setup. 

For this reason, we see no reason that there would not be linkage 
to other Federal computer systems in the future. I think legislation 
would have to be mandated to prevent this. 

Mr. Drinan. I welcome your comments. I yield at this time to 
the gentleman from Virginia, Mr. Butler. 

Mr. Butler. Thank you, Mr. Chairman. I would prefer to defer 
to Mr. Erlenborn. 

Mr. Drinan. I would be happy to yield to the gentleman from 
Illinois, Mr. Erlenborn. 

Mr. Erlenborn. Thank you very much, Mr. Chairman. 

Ms. Rogers, I would like to follow up on a question that Father 
Drinan asked about the tie-in on this Department of HEW comput- 
er bank of information to other parts of the Federal Government, 
the insurance industry, and so forth. 

Are you familiar with the so-called Privacy Act? 

Ms. Rogers. Yes. 

Mr. Erlenborn. You are aware that would prohibit such tie-ins 
or other uses of the information other than those published in the 
Federal Register? 

Ms. Rogers. Yes. 

Mr. Erlenborn. Don't you think that is a safeguard already 
existing? 



312 

Ms. Rogers. There is some safeguard in that. However, I have 
some question by virtue of the statutory authority under which 
HEW is creating the data bank, which is the Fraud and Abuse Act. 
I would have some question as to whether or not there are loop- 
holes in this process whereby this information could be linked in 
spite of the Privacy Act. 

Mr. Erlenborn. You are aware that under the Privacy Act 
whatever use is contemplated as being made of this information on 
a regular basis must be published in the Federal Register so that 
you and the general public would know what uses are being made 
of the information. Then if you object, you would have an opportu- 
nity to object and come to the Congress or go to HEW to try to 
prohibit them from making that ordinary and customary use. 

Ms. Rogers. Yes. 

Mr. Erlenborn. Don't you think that is a safeguard that now 
exists? 

Ms. VoLZ. I would think we as a professional organization that 
reads the Federal Register might be aware of that, but many 
individual patients would not. On that basis, I think there could be 
possible abuse. 

Mr. Erlenborn. Of course there are 220 million people in the 
United States who are not aware of what is in the Federal Regis- 
ter. It is not the best seller really. It has wide dissemination. That 
is the reason for the existence of organizations such as yours, is it 
not? 

Ms. VoLz. Yes. 

Mr. Erlenborn. The reason is to maintain vigilance? 

Ms. VoLZ. Education of the public is one of the problems. Many 
abuses go on because of the ignorance of the public. That is the 
reason for our concern. 

Mr. Erlenborn. I am extremely pleased to have been associated 
personally with the passage of the Privacy Act. I think the mere 
fact that we have required the Federal agencies to publish and 
identify every record system that they maintain was a great step 
forward. We all know what is being done now. Some of the agen- 
cies found out for the first time themselves what they were doing 
because they were forced to catalog their systems, describe them, 
and publish them. 

Second, to publish the customary use of those records lets us all 
know what the ground rules are. This has been a great step for- 
ward. It gives us a great deal of protection. 

Relative to Federal legislation, you made the comment that it 
would be desirable to have uniform rules. Would you make the 
same judgment when it came to licensing of dentists, physicians, 
nurses, hairdressers, automobile drivers, registration of auto- 
mobiles, and a myriad of other licensing and registrations that are 
done at the State level? 

Ms. VoLZ. There are so many ramifications to all those. I would 
think regional differences would have to be taken into considera- 
tion. I would prefer not to answer that question without a little bit 
more preparation. 

However, the reason for saying that Federal legislation would be 
very helpful is based on looking at the State regulations, those 



313 

State laws presently in effect. There is a tremendous variance 
among them. 

The one in the State with which I am familiar, Pennsylvania, 
has two sentences which give the patients access. It offers no 
guidelines to those regulations. It has a simple statement saying 
that this is the patient's right to have it in a completely unrelated 
place. It makes it difficult for interpretation. 

Other State laws are less than that, and some are much more 
specific than that. They do not all address the basic issues that the 
proposed legislation does. Therefore, in order to assure that the 
good things in the proposed legislation are carried through uni- 
formly is my reason for saying Federal legislation would be helpful. 

Mr. Erlenborn. I will just make this personal comment. I have 
been disturbed in recent years by the volume of people turning to 
the Federal Government because it is so much easier to get a job 
done in one place than in 50 different places. If that had been the 
philosophy 50 or 100 years ago, we never would have had the types 
of regulations that I have just described — automobiles, doctors, den- 
tists, hairdressers, and so forth. Those never would have developed 
in the way that they have. 

That philosophy rather reminds me of the labor union organizer 
that I ran into in my law practice who went to the owner of a 
business and said, "I want you to sign a contract recognizing our 
union as the sole bargaining agent of your employees." 

The employer said, "Well, if a majority of my employees want 
you to be their bargaining agent, that is OK with me but you had 
better go talk to them." 

His answer was, **oh, no, it is so much easier to get you to sign 
this. All I have to do is convince one person rather than a couple 
hundred people out there in your plant." 

It is easier, but I question whether it is the right way to go about 
it. 

Thank you very much. 

Mr. Drinan. I yield to the gentleman from Virginia, Mr. Butler. 

Mr. Butler. Than you, Mr. Chairman. 

I have appreciated the testimony of the witnesses. I have read it 
with some interest. 

I guess I always want some horror stories for the record. Do you 
have a few you might want to give us at this moment? 

Ms. Rogers. I think we both probably have a few. I could start 
off with this: 

One area of concern in which there have been some abuses has 
been the area involving the health facility, the insurance company, 
and the employer in the transfer of information on a legitimate 
basis to the insurance company. There are cases cited whereby 
medical information, including the diagnostic information, on pa- 
tients has been transferred by signature of the patient to the 
insurance company. Where an employer would hold a group health 
policy, the employer then obtains information from the insurance 
company on the employee. 

There are two cases that I could cite where there is abuse of 
confidentiality. One involves a husband or wife who is the employ- 
ee of the company who receives information on the entire family, 
the nonemployed husband or wife, through the insurance company 



! 314 

by the employer. In essence this is the husband or wife obtaining 
information about the other without their signed permission. 

Mr. Butler. I can see how that would be frightening. 

Ms. Rogers. Another is a psychiatric case that was stated. A 
woman went in for a psychological checkup and did improve and 
return to work. Through her employer she received a piece of 
paper in which she was diagnosed as a schizophrenic. The knowl- 
edge of the diagnosis itself, plus the knowledge that the employer 
and people in the employ of her employer knew this, provided a 
setback for her. 

This, of course, is a particular area of sensitivity in the psycho- 
logical realm where very often the psychiatrist will not divulge the 
full contents of the record to the patient. That is one area that is 
particularly sensitive. For a patient to get this information through 
the insurnce field and the employer is particularly a bad situation. 

Mr. Butler. Would you characterize abuses as widespread? How 
big a problem is this? These are the horror stories. How big a 
problem is this percentagewise? 

Ms. VoLZ. It would be hard to give you actual statistics. They do 
exist. In what proportion to the whole it is difficult to know. Not 
everybody knows what the aggregate information is. I would not 
even want to venture a guess as to what the percentage would be, 
but I think it is very definitely there. 

Mr. Butler. Thank you. 

Mr. Drinan. I am happy to yield to the gentleman from Ohio, 
Mr. Kindness. 

Mr. Kindness. Thank you, Mr. Chairman. 

I have no questions. However, I would like to present my apolo- 
gies for not being here sooner this morning. 

Mr. Erlenborn. I have one further question. 

In scanning very quickly the testimony of one of the other wit- 
nesses to be here this morning, Jerome Beigler, I notice a reference 
in his testimony on page 6 to an APA— and I guess that is the 
American Psychiatric Association — model State law and a new 
Illinois confidentiality law. 

Does your association have a model law to suggest to the States? 
Have you worked with the National Commission on Uniform State 
Laws? Have you worked in that way to try to get good laws at the 
State level? 

Ms. Rogers. We do not have a model State legislation proposal. 
The activity of our membership has been through the State legisla- 
tive committees of the medical record associations. However, the 
national association has not worked on model legislation with the 
States at this point. 

Mr. Erlenborn. I recall when I was in the State Legislature in 
Illinois. We often would enact model State laws, sometimes with 
practically no amendment from the proposed State law. This in- 
cluded banking laws to have uniformity in handling checks and 
other mediums of exchange of goods and valuables. It seemed to 
have worked quite well. We have a banking system that is con- 
trolled to a great extent at the State level. We have rather uniform 
laws State to State. 

I am wondering if that is an approach to be examined at least in 
this area of confidentiality of medical records rather than auto- 



315 

matically turning to Washington because it is so much easier and 
quicker. 

Ms. VoLZ. That could be an approach, but it is partly what I was 
addressing earlier, Mr. Erlenborn — talking about the tremendous 
variety among State laws which are presently enacted. There are 
probably about 18 of them that go all the way from the terseness of 
the one I mentioned in Pennsylvania to much more elaborate ones 
for other States. There does not seem to be any uniformity among 
them. I am not aware of what types of guidelines may have been 
given to them in terms of uniform model laws, but I doubt if very 
much has been. 

It appears that the State laws which have been enacted in some 
instances literally pick up portions of passages from the Privacy 
Act or other proposed legislation by other States and other organi- 
zations. They are simply submitted in toto without any variance at 
all. There is where you get into trouble because they have no 
consistency. 

Mr. Erlenborn. I think that is often the condition that leads to 
activity on the part of the Commission on Uniform State Laws. 
Maybe we are just at the beginning of the process. 

Thank you very much. 

Mr. Drinan. I share the reservations of the gentleman from 
Illinois, Mr. Erlenborn. I know that colleges, for example, have 
accreditation all done by voluntary means. The Uniform Commer- 
cial Code was developed and is totally consistent in the 50 States. 

In any event, as Mr. Erlenborn suggested, we are at the begin- 
ning, I take it, of the resolution of a problem which apparently is 
somewhat widespread. 

Are there any other questions? 

Mr. Kindness. I would like to pursue one avenue of questioning. 

Is there any experience either of you have, or have knowledge 
about, with State laws relating to patient access to medical records, 
satisfactory or unsatisfactory? What sort of guidance might we get 
from experiences in States with such laws in place? 

Ms. VoLZ. I do have some personal experience in that area. 
Pennsylvania has had that kind of law in effect since last May. It 
was enjoined for a time. Many institutions ignored the enjoiner 
and allowed patient access. In our hospital, Thomas Jefferson Uni- 
versity, which has approximately 21,000 discharges a year, which 
would give you an idea of patient activity, we have had probably 15 
requests from patients for access to medical records. There also 
have been some inquiries about patients that were related to medi- 
cal record information but the patient did not quite know hovv to 
go about finding what he wanted to know. When he was advised 
that he could have a copy of his record or come to see it, he was 
very pleased and in some instances made attempts to do so. 

One of the provisions in our administrative policy regarding 
patient access provided for the psychiatric patient to be able to 
review his record first with a physician for interpretation. In every 
instance the psychiatric patient refused that. He wanted to review 
his record himself. 

There were some patients who were interested in seeing whether 
or not there was potential for medical malpractice. Others were 
simply curious because they had had nagging questions all their 



316 

lives about something that happened to them many years ago and 
felt they did not have a satisfactory explanation. 

In our area the pediatric hospitals have found great interest 
among parents to obtain access to and copies of the medical records 
of their children, partly because they are mobile and will need this 
information to be transferred with the children and, second, be- 
cause they have some questions about whether or not there are 
hereditary diseases or other familial problems that they might 
have as a result of one child's illness. 

Does that answer your question? 

Mr. Kindness. Yes. Would it be possible to quantify the latter 
portion of that relating to the records in the case of pediatric 
patients as compared to the time before such a law was in place? 
This normally would have occurred in some measure. I would 
think a lot of parents would have obtained access to their chil- 
dren's records for the purposes of transit to another location. 

Ms. VoLZ. They do but it rarely goes to the parent. The practice 
of hospitals has generally been not to allow patient or parent 
access. The way most health care institutions handle it is to have a 
request received from the parents or the patient to send it directly 
to the next facility, rather than going through the patient himself. 

Of course the doctor-patient relationship exists between the pedi- 
atrician and the parent. However, apparently not all parents feel 
that is satisfactory. 

Mr. Kindness. Again, is there any quantification that might be 
employed in describing the difference here? 

Ms. VoLZ. Probably an increase up to as high as 10 percent in 
the Children's Hospital of Philadelphia in terms of patient-parent 
access now as opposed to none prior to that. The total of release of 
information from one health care facility to another might be as 
high as 5 percent of all patients, 10 percent of all patients, over a 
long period of time who request their information be sent to a 
second treating institution or a third. Of all patients seen, that 
hospital's experience has been approximately 10 percent of all the 
pediatric parents are asking for information from their children's 
records, as opposed to none from that direct route before. 

Mr. Kindness. Would you care to venture any opinion or com- 
ment as to whether the current situation as to parent access in the 
case of pediatric records in particular is better than what existed 
before with the direct transfer to other institutions? 

Ms. VoLZ. That is pure speculation, based on the reaction of 
patients with whom we have had experience where they seemed to 
be satisfied, much more satisfied than they were previously, before 
having had access to the record. Whether or not it has any true 
beneficial effect would be very hard to measure. 

Mr. Kindness. In regard to a general population of patients, 
would it be similar? 

Ms. VoLZ. It would be similar. 

There is a hospital in New Jersey which has a policy that re- 
quires all patients to review their medical records before discharge 
from the hospital. It is their feeling that the patient is much better 
able to understand his illness and participate in his home treat- 
ment in a much more meaningful way than he ever was in the 
past. That assumes a certain level, first of all, of interest; second. 



317 

knowledge; and, third, commitment to himself. Whether or not that 
truly has any long-term effect, it will be a long time before we 
know the answer to that. 

Mr. Kindness. Thank you very much. 

Mr. Ingram. We talked earlier about the difficulty with State 
law standards. Could you give us some idea as to how much inter- 
state transfer of medical records there is? Is this common with 
most of the records? 

Ms. VoLZ. This is very, very common because patients receive 
treatments at any number of places during their lifetime. Even 
overseas we have requests for information from medical records 
previously made as a result of treatment at a State-side institution. 

Mr. Ingram. Let's say an insurance company requests medical 
records and then receives them. Are there restraints placed on the 
amount of sharing that the insurance company or receiver of the 
records can have? Are there any restraints at all as to what they 
can do with the records at that point, once they have received 
them? 

Ms. VoLZ. Not by the health care facilities in the general patient 
population, but some local and State laws regarding psychiatric 
medical records, which were recently enacted at least in our State, 
do require that we advise the recipient of the records that he may 
not re-release the information. However, that is not in the general 
patient population for the most part. 

Mr. Ingram. As a practical matter, there is no restraint placed 
on the receiver of the recprds as to what that individual or compa- 
ny may do with the records? 

Ms. VoLZ. That is correct. 

Mr. Ingram. Normally what check would a hospital provide on a 
requester of the records? In other words, if I were to send you a 
letter on the letterhead of an insurance company requesting some 
records, is there any check that you would go through to determine 
whether or not the requester of the records is in fact an insurance 
company? What are the normal standards among the profession? 

Ms. VoLZ. First, the normal standard would be to require the 
patient's authorization for release of that information to you. Very 
often we already have an indication on the medical record by the 
fact that the source of funding for that admission was already 
identified. Usually that is already known to us. Frequently insur- 
ance companies that were unknown to the provider who are offer- 
ing life insurance do request information, but it is stated there that 
they are providing life coverage or looking for information to deter- 
mine whether or not they should assume that liability. 

The first screen of the request for the information would be by 
the patient's authorization. If it was not present, the information 
would not be sent. 

Mr. Ingram. The patient has already given a blanket authoriza- 
tion. In that case would you go beyond that and seek to find out 
more about the requester? 

Ms. VoLZ. Not usually, no. The information would have to be in 
writing. We would not accept verbal requests over the telephone. A 
copy of what was sent would be retained in the record for future 
reference should there be some abnormality or unusual circum- 
stances with an improper request. 



318 

Mr. Ingram. As a practical matter, as long as the request was in 
writing that would be sufficient? 

Ms. VoLZ. And on a letterhead, yes. 

Mr. Ingram. We talked a little bit earlier in your testimony 
about the fact that often an entire record of an individual would be 
xeroxed and provided to the requester. As a practical matter, 
would there be a manner in which you could segregate out sensi- 
tive data or the types of data that the particular requester would 
be interested in? 

Ms. VoLZ. Yes. The way that would be handled would be to have 
the requester specify exactly what he is interested in and provide 
that portion of the record only and block out the remainder. 

Mr. Ingram. Would this be prohibitive in terms of the cost to the 
record manager? 

Ms. VoLZ. It could present some difficulties in selectivity of pas- 
sages from the record, but costwise it would not be prohibitive. 

Mr. Ingram. Do you have any estimate of the cost of the admin- 
istration's bill, or whether or not this cost would be any greater 
than the current expenditure for records management in a particu- 
lar hospital? 

Ms. VoLZ. We do not perceive those costs being inordinate. As 
has already been stated, there probably would be startup costs in 
terms of notices to the patients that this is what existed. Many of 
the health care institutions already have patients' bills of rights 
and admission-type information which is given to them, telling 
them about their association with the health care institution, 
which include passages that say, "You may have access to your 
medical records. We will offer an interpretation of the content to 
you." Those costs were not prohibitive when they were done. 

Mr. Ingram. Would it require a hospital to go out and double the 
size of its records staff? 

Ms. VoLZ. No, I do not think so. 

Mr. Ingram. Thank you. 

Mr. Drinan. Mr. Gellman. 

Mr. Gellman. I would like to ask one question based on your 
statement that data compiled as part of a research project should 
not include patient identifiers without the consent of the patient. 
The research community tells us this would interfere substantially 
with the conduct of some research studies, particularly longitudi- 
nal studies. Would you comment? 

Ms. VoLZ. It would increase the difficulty for researchers, but in 
many, many instances the patient is identifiable through a 
number. We question whether or not it is necessary in most of the 
instances of research to actually identify the patient in any other 
way except by that number. It is always retrievable by individual 
name and address if you need to followup the patient because of 
specific information that you learned in the research program of 
which the patient should be aware. 

I am thinking of some public health issues — for instance, such as 
Legionnaire's disease — that could and should have patient identifi- 
cation. However, the majority of the type of research that goes on 
with which we are familiar in the health care delivery system does 
not, in order to be effective, need as much individual identification 
as perhaps some people are saying. 



319 

Mr. Gellman. Are you suggesting when information is released 
to a researcher that it might include an identification number that 
the hospital could use to track down a patient later on? 

Ms. VoLZ. Yes. 

Mr. Drinan. Mr. Morr. 

Mr. Morr. You mentioned the Joint Commission on Accredita- 
tion of Hospitals and HEW established four standards for medical 
records. Do those standards provide much guidance in terms of 
access to medical records? 

Ms. VoLZ. No. 

Mr. Morr. Would it be possible through those bodies to provide 
standards short of Federal legislation? 

Ms. VoLZ. I think it would be. The joint commission particularly 
would be very effective in this. The only areas in the delivery 
system that would not be covered would be the ones that are 
presently not included under the joint commission standards — for 
instance, ambulatory facilities. Of course with the trend in delivery 
systems going toward more ambulatory care, that could be a big 
area that is not covered. 

Mr. Morr. Is there a professional body that covers ambula- 
tory 

Ms. VoLZ. They have their own organizations. It is my under- 
standing that many of them are voluntary. 

Mr. Morr. One of the things about which I am concerned is 
whether or not a doctor reviews patient records with a patient. You 
mentioned, or Ms. Rogers mentioned in her testimony, that some 
States provide a procedure for doctors to review records. Do you 
think that procedure is beneficial? 

Ms. VoLZ. Usually it is. The only problem with it is it would be a 
horrendous thing for doctors to have to do in terms of time with all 
of their patients. 

Mr. Morr. Do you know of the existing State laws how many 
either require or recommend that kind of thing? 

Ms. VoLZ. No, sir, I do not. 

Mr. Morr. Would access to medical records by patients, un- 
trained laymen, lead to some misunderstanding of those records? 

Ms. VoLZ. It could. First, it would be difficult for the patient to 
understand the handwriting in many instances. Second, it would be 
hard to know what the meaning of the medical terms was. Some of 
the jargon that is used in health records has been misunderstood 
by patients in my own personal experience. Therefore, it would be 
advisable if a physician or a patient advocate could interpret to 
patients specific aspects about the medical care. 

However, very often in our experience when patients have looked 
at their records they wanted to know certain details that were 
recorded about them — for instance, about their alcohol history or 
other personal details — to see whether or not they were in there. 
They did not comment to us beyond that point, however. 

Mr. Morr. You mentioned some patients look at their records to 
see if there is a possible case of medical malpractice. 

Ms. VoLZ. Yes. 

Mr. Morr. Do you think the lack of understanding of this jargon 
would increase or decrease the likelihood of malpractice cases? 



320 

Ms. VoLZ. I think it is a real risk. It has been in about 2 cases of 
about 12 to 15 that we have had where malpractice suits have 
evolved. However, I think the same ones still would have evolved 
whether or not there was patient access or not. The patient was 
reinforcing his suspicion that there was reason for suit in the first 
place. It would probably speed up the process. As you know, at 
present a suit must be instituted in most instances to have access 
unless there was voluntary access. 

Mr. MoRR. I have a question for Dr. Beigler. It is this: Should a 
patient have access to information obained by a doctor or a psychi- 
atrist that is obtained in confidence from a third party? Are there 
problems there? 

Ms. VoLZ. We can see problems there, yes. 

Mr. MoRR. What restrictions to access would you recommend to 
deal with that. 

Ms. VoLZ. To the secondary access? 

Mr. MoRR. That is right. 

Ms. VoLZ. That there be agreement by the person who recorded 
the information, the third person or second person who recorded 
the information, that that be reviewed by that individual. My 
inclination would be to refer the patient to the person who 
recorded the information in any instance. 

Mr. MoRR. Thank you, Mr. Chairman. 

Mr. Drinan. Thank you. It is a different type of experience these 
days when somebody recommends more regulation and another 
Federal bureaucracy. So we welcome you and thank you for your 
testimony. 

I know you will be in touch with counsel if you have any addi- 
tional points. 

[Additional material and letter supplied by Ms. Rogers:] 



321 



Confidentiality of Patient 



Health Information 




A 

Position 
Statement 

of 

the 

American Medical Record Association 



322 




The basic research and assembly of this mate- 
rial, which now becomes an AMRA Position 
Statement, was first prepared as a Report by 
the Legislative Committee of the Pennsyl- 
vania Medical Record Association in 1976-77, 
as funded by AMRA's Executive Board. For 
these efforts, AMRA is most grateful. 

That Report was then modified and subse- 
quently adopted by the AMRA Executive 
Board in December 1977. 



Confidentiality of Patient Health Information 

A 

Position Statement 

of 

the 

American Medical Record Association 



Preface 

The Executive Board of the American Medical 
Record Association is proud to present this 
confidentiality document which states our position 
regarding the appropriate collection, dissemination 
and protection of an individual's personal health 
information. 

At this time, when legislation is being prepared 
at the national, state and local levels regarding 
protection of privacy, confidentiality and freedom 
of information, it is imperative that our Associ- 



ation and its members, who are responsible for 
development of ethical practices to safeguard the 
information entrusted to their care, clearly affirm 
their position in this regard — to health care pro- 
viders, third-party payors, government agencies, 
national and state health officials and legislators. 

The Executive Board strongly encourages each 
member to work diligently toward implementation 
by all health care providers of the letter and spirit 
of this report, including adoption of policies based 
on the model included herein by all health care 
providers. 



323 



Table of Contents 

I. Introduction 
II. Philosophy 

III. Current Usage of Patient Health Information 

A. Release of Information 

1. Confidential Information 

2. Non-confidential Information 

B. Users and Uses of Health Record Information 

A. Health Care Providers, Institutional and Individual 

B. Payors for Services, Private Insurance Plans, Government Insurance Plans and 
Programs. 

C. Social Users 

IV. Problem Areas In The Use of Health Information 

A. Ownership of the Health Record and Health Information 

B. Patient Education 

C. Nature and Extent of Information Collected, Stored, and Accessed 

D. Informal Consent 

1. Blanket Consent 

2. Prospective Consent 

3. Perpetual Consent 

E. Security Policies and Procedures 

V. Emergence of Privacy As a Public Issue 

VI. Model Policies for Maintenance of Confidentiality of Patient Health Information 
1.0 Data Collection 
2.0 Storage 
3.0 Access 



I. Introduction 

The American Medical Record Association 
(AMRA) has traditionally been 'of service to its 
members and other health care professionals and 
agencies by providing guidance in the development 
of policies and procedures to those concerned with 
the collection, storage and dissemination of health 
care information. 

AMRA has, since its founding in 1928, been 
committed to the highest ethical standards for its 
member practitioners. This position statement 
reflects a continuing concern in the development 
of laws, regulations and policies affecting health 
care information. 

AMRA's members are, by training and experi- 
ence, qualified to provide leadership in information 
systems which serve the needs of the patient, the 
institution and the public. 

Through this position statement, AMRA 
establishes the concerns of its members over the 
abuses of confidentiality of health care information. 



II. Philosophy 

The primary purposes of the medical record are 

a. To document the course of the patient's 
health care. 

b. To provide a medium of communication 
among health care professionals for current 
and future patient care. 

In order to fulfill these purposes, significant 
amounts of data must be revealed and" recorded. 
The patient must be assured that the information 
shared with health care professionals will remain 
confidential, otherwise the patient may withhold 
critical information which may affect the quality 
of the care provided. 

Economic issues, social issues, and technological 
advances have eroded the traditional relationship 
of confidentiality which exists between the patient 
and health care professional. Substantiation of pay- 
ment claims has generated an increasing number 
of requests for information from patient health 



324 



records. At the same time, the increase in the 
amount of computerized health data, the develop- 
ment of large data banks and the advancement of 
record linkage, pose a threat to the privacy of 
medical information. The public is generally un- 
aware of this threat and the consequences of a loss 
of confidentiality in the health care system. Ade- 
quate measures to safeguard medical privacy must 
be established. 

AMRA recognizes that patient health informa- 
tion provides a sound data base for a variety of 
legitimate activities. Through this statement, 
AMRA reaffirms the patient's right to privacy, in- 
cluding the privacy of the medical record. While 
the patient does not have the property right to the 
record, he should have the protected right of in- 
formation. Further, in keeping with the spirit of 
informed consent, AMRA supports the right of 
the patient to have access to his own medical 
record, unless there are specific contraindications 
such as; a. Minors, b. Those deemed legally in- 
competent, c. Specific restriction by attending 
physician that access could be detrimental to the 
patient. 

Therefore, subject to applicable authorized pro- 
visions, release of any individually identifiable 
medical information for any purpose other than 
direct patient care, must be done only with the 
expressed authorization of the patient or his 
authorized agent. 

Further, AMRA recommends greater emphasis 
on the patient's right to privacy through: a. The 
establishment of written policies for the collection, 
storage and dissemination of information, b. On- 
going educational programs for all staff and per- 
sonnel to enforce these policies. 

With respect to this right of privacy, AMRA 
urges the development and implementation of 
programs to: 

1. Protect the patient from invasion of privacy 
by protecting against indiscriminate and un- 
authorized access to confidential health in- 
formation; 

2. Promote appropriate usage and maintenance 
of confidentiality once health information is 
disseminated to authorized persons; 

3. Educate the patient and the public to: a. 

Their rights of confidentiality b. Their 

right to restrict or limit dissemination of 
identifiable medical information, c. Their 
right of access to that information. 



III. Current Usage of Patient Health 
Information 

A. Release of Information 

Health care facilities receive and respond to 
numerous requests for information from the 
medical records in their care. The requests may 
be written, by telephone or in person, from a 
broad spectrum of users. The responses are usually 
written, but in emergencies, may be given by tele- 
phone or to the patient or his representative. The 
health care facilities ordinarily consider the in- 
formation to be released to fall into two categories: 

1. "Confidential" information which requires 
the patient's written authorization or per- 
mission to release. 

Confidential information is provided to users 
such as insurance companies, credit agencies, 
attorneys and others who will use it for non- 
patient care purposes. The authorizations are 
obtained from the patient by the insurance 
company, attorney, etc., at the time the 
initial agreement is made. Many are worded 
to permit the collection of information from 
any future medical records the patient's 
health care may generate. On some occasions, 
"confidential" information may be released 
without the patient's written authorization, 
but with his implied consent, usually to those 
who are currently caring for the patient. A 
record of what information and to whom it 
was released and a copy of the authorization 
are usually kept as part of the original 
medical record. 

2. "Non-confidential" information or that in- 
formation which may be released without 
the patient's authorization. 

Most health care institutions have policies, pro- 
cedures and systems for the controlled dissemina- 
tion of information from their medical records to 
appropriate users. 

B. Users and Uses of Health Record Information 
The medical record is a compendium of infor- 
mation about an individual patient during the 
course of treatment of an episode or episodes of 
illness(es), or while maintaining an individual's 
state of health. 

The record is made up of components, arranged 
in a logical sequence. The components include the 
physical and mental history of the current and 
previous illness, social factors which may con- 
tribute to the illness such as job, marital or other 



325 



personal conflicts, the findings on physical exam- 
inations, results of diagnostic tests such as x-rays, 
electrocardiograms, laboratory values, findings 
and opinions of consulting specialists, the treat- 
ment prescribed, a description of the patient's 
response to that treatment (or lack of response), 
diagnoses, operations and the plans for and goals 
of follow-up care. The primary reason for the 
collection of this sometimes voluminous and sen- 
sitive information is patient care. 

The content of the medical record is developed 
as a result of the interactions of the members of 
the health care "team" who use it as their com- 
munication tool. The "team" is an interdisciplinary 
group which includes physicians, nurses and 
numerous allied health personnel. 



They inform and advise each other through 
their entries in the record about their findings, ob- 
servations, opinions and treatment of the patient. 
At the conclusion of treatment of the episode of 
illness the record is sent to the medical record 
department where it is processed. 

Medical record department personnel are re- 
sponsible to design and implement a system to 
provide for evaluation, retention and future utili- 
zation of patient information. Patient information 
is used to plan patient care, perform medical re- 
search, evaluate patient care and provide infor- 
mation to authorized users. 

Current users of medical information and the 
purposes for which the information is used may 
be classified as follows: 



USERS OF MEDICAL 
RECORDS 

A. Health Care Providers, 
Institutional and In- 
dividual 

(Primary Users) 



Payors for Services, 
private insurance plans, 
government insurance 
plans and programs 
(Secondary Users) 



USES OF INFORMATION IN MEDICAL RECORDS 

1. as a medium of communication among health care providers 
during the current episode of illness 

2. as a reference for treatment of future illnesses 

3. for training of physicians and other personnel — to assist students 
to relate theory with medical practice 

4. for prospective and retrospective evaluation of the quality of 
patient care through review and analysis of patterns of care as 
documented in the medical record 

5. for promotion of effective and efficient use of facilities, equip- 
ment, services, personnel and financial resources through statis- 
tical analysis of information abstracted from the medical record 

6. for documentation of voluntary compliance with standards for 
accreditation of the institution 

7. for research aimed at the improvement of treatment, assessment 
of disease detection methods, assessment of the effectiveness of 
medication and other treatments through study of appropriate 
cases 

8. for documentation which demonstrates conformity to govern- 
ment regulations 

9. follow-up care of patients with long-term illnesses and assess- 
ment of the efficacy of the care given 

1. for substantiation of patient claims for payment of health care 

services 

2. for audits of claims for health care services and professional fees 

3. to monitor the quality and equity of care and services rendered 
to those insured 

4. to assess and control the cost of health care services to those 
insured 



326 



C. Social Users 

1. Public Health 
Agencies 



2. Medical and Social 

Researchers, insti- 
tutional and extra- 
institutional 

3. Rehabilitation and 

Social Welfare 
Programs 



4. Employers 



5. Insurance Companies 



6. Government Agen- 

cies: federal, 
state and local 

7. Education Institu- 

tions 



8. Judicial process 



9. Law enforcement 
and investigation 

10. Credit investiga- 

tion agencies 

1 1 . Accrediting, Licens- 

ing and Certi- 
fying Agencies 



1. in surveillance of diseases of epidemiologic significance through 
statistical analysis of information abstracted from medical 
records 

1. for investigations of disease patterns, effects of disease on func- 
tions of daily living, including occupational health and safety 



1. in determination of need for specific types of rehabilitation pro- 
grams through analysis of incidence data 

2. in development of individual rehabilitation and training plans 
for participants in programs for the handicapped, retarded and 
drug and alcohol abusers 

* 1. for administration of employer-provided health insurance plans 
*2. for determination of employment suitability 

3. in treatment and analysis of job related injuries and correction 
of occupational hazards 

4. to determine disability 

♦ 1 . in determination of risks in writing insurance 
2. in determination of liability for claims 

1. for allocation of government resources for schools, health care 
facilities, education institutions, etc. based on vital statistics sub- 
mitted from medical records 

*1. for assessment of suitability for admission to selected education 
programs 

2. for maintenance of student and employee health programs 

1. in adjudication of civil and criminal matters through use of the 
medical record as evidence through the legal process 

2. in judicial process for involuntary admission of mentally ill. 

* 1 . in criminal investigation 

*2. for security clearance programs 

♦ 1 . for determination of credit eligibility 

1. for demonstration of individual fulfillment of criteria for pro- 
fessional licensing by a state government agency 

2. to ascertain competence of practitioners 

3. for determination of compliance with criteria for hospital based 
education programs 

4. as documentation of compliance with standards for institutional 
accreditation 



327 



12. Media: press, 
radio, TV 



1. for announcements of developments in medical research 

2. for reporting of health hazards, diseases affecting the public 
health and newsworthy events. 



♦May in some instances be improper use. 



IV. Problem Areas in the Use of 
Health Information 

In a record-generating society, the maintenance 
of confidentiality is subject to a number of pres- 
sures through all stages of collection, storage and 
retrieval. The result of these pressures is most often 
the unauthorized access to information, either 
through routine indiscriminate dissemination or 
through failure to establish adequate policies and 
procedures governing individual and organization- 
al access to identifiable data. There are several 
relevant problem areas which are to some degree 
interrelated. 

A. Ownership of ihe Health Record 
and Health Information 

The issue of ownership of the patient health 
record, as distinct from ownership of the infor- 
mation therein, is one which has not been resolved. 
While the patient may to some extent control 
access to his record by refusing consent to release 
of information, in many states he himself has 
access only through litigation or in accordance 
with the policy of the individual institution. In the 
private sector*, the physical document itself is not 
the patient's property, and in few cases is a full 
copy made available to him. In addition, many 
health care providers consider the document and 
its contents to be their own property, generated 
by them; by virtue of this "ownership" they feel 
themselves justified in exercising control over its 
release to the patient. For the most part, providers 
and institutions have failed to fully address the 
issue of ownership and its attendant implications 
for policy and procedure development. There may 
be somewhat casual access to the record by almost 
anyone except the patient — by transporters and 
processors of various levels of training and re- 
liability. Access may also be obtained by un- 
authorized and in many cases unidentified users, 
both internal and external to the facility. Another 
by-product of refusal of patient access has been 
the recording of inaccurate and inconsistent in- 

*as opposed to governmental institutions. 



formation with minimal review conducted for rele- 
vance. 

B. Patient Education 

For the most part, patients are unaware of the 
full range of purposes for which the record is used, 
or of policies governing the release of informa- 
tion. They are mainly aware of those uses personal 
to them, such as planning of individual health care, 
or protection of legal interests in such matters as 
personal injury suits or applications for life in- 
surance. Less well-known uses are those of 
medical care evaluation, research (whether internal 
or external to the institution), planning for facil- 
ities, and meeting the requirements of licensing, 
accrediting, and certifying bodies. Few have any 
concept of the quantity of information released to 
third parties, governmental or private. 

There is growing emphasis on patient knowledge 
of self-care as appropriate criteria for patient care 
audits. This concept must be broadened to include 
patient knowledge of the record, its contents and 
its uses. It is the responsibility of the health care 
providers to act as educators — to focus on the 
knowledge deficit in the patient population and 
by correcting it to include the patient as an active 
contributor to the health care team, to the accuracy 
of his record, and to the assurance of its appro- 
priate use. 

C. Nature and Extent of Information 
Collected, Stored and Accessed 

The health information gathered today is sub- 
stantially different from that gathered in an era 
preceding the multipart form and word processing. 
Patient mobility and professional specialization 
mean that one family physician no longer carries 
the family health history in his head, with the aid 
of a few pertinent notes. Multiple providers mean 
that the record is a major central communication 
tool. Also, external agency needs and legal re- 
quirements affect data collection; social and family 
histories are now required by both accrediting and 
governmental agencies, for example. Thus, more 
and intimate detail of the patienf s personal habits, 



328 



social relationships, emotional and mental status, 
attitudes and preferences is being collected as part 
of medical data. This information is generally 
' disclosed willingly by the patient but with the 
understanding that the confidentiality of the com- 
munication will not be breached. Routine proces- 
sing, storage and retrieval functions are performed 
on the record as a whole; usually no data are 
screened or removed at any point. Consequently, 
a great deal of highly sensitive identifiable infor- 
mation may be retained for decades without re- 
view for relevance or propriety. 

The sequel to prolonged storage of all informa- 
tion as a unit is often the release of that entire 
unit. A notable example is that of information re- 
leased to insurance companies whose attempts to 
insure payment for no more care than is necessary 
have led to demands for far more data. These 
demands, together with facilities' budgetary crises 
and personnel reductions, have led to the frequent 
practice of indiscriminate photocopying in order 
to keep up with the workload. This results in 
volumes of unedited data released to third parties 
without restriction of use to a specific need and 
without requiring destruction of the information 
or of personal identifiers as quickly as possible. 
It has, in fact, proven almost impossible to discover 
what happens to such information; whatever 
policies for identification, retention and release 
exist within the agencies have seldom been made 
known to either the public or the health care 
providers. 

D. Informed Consent 

As may be inferred from the preceding para- 
graphs, the practice of obtaining informed consent 
is notable chiefly by its absence. There are at least 
three facets to this particular problem. 

First, in "blanket consent", patients or guardians 
are asked to sign releases which allow facilities to 
disseminate "any and all" identifiable information 
to whomever is offering a benefit or service to the 
patient. The patient is not himself "informed" as 
to the full extent of the record's content, which 
segments of it will be open to third party access, 
or what will happen to the information once it is 
in the third party's possession. "Blanket consent" 
does not serve to instill a sense of responsibility 
in the collectors, storers and users of patient data. 

Second, difficulty arises from the common third- 
party practice of requesting "prospective consent", 
or consent of release of information prior to treat- 
ment. This means that the patient is consenting to 



the dissemination of that which is not yet collected, 
a practice which precludes any intelligent decision- 
making on the part of the patient. 

Third, most insurance companies request a 
form of consent which could be construed as 
"perpetual consent," since there is no attendant 
time limit set for validity of the consent. With 
other requestors, health care institutions vary in 
the time limits within which they accept patient 
consent as "current." In some cases health care 
institutions are adopting more stringent limits, but 
there is no uniformity of policy in this area. 

E. Security Policies and Procedures 

Failure to fully acknowledge that the facility 
owning an information system is directly respon- 
sible for its uses has led to practices which do not 
always support the ethical principles of confiden- 
tiality. This applies both to intra- and to inter- 
institutional transactions. In a health facility a large 
number of persons handle personal information, 
often at locations remote from any central control 
area. Partly as a consequence of numbers and in- 
convenience, close monitoring of their activities is 
not routine. The categories of persons involved 
include transporters (e.g. patient escorts, elevator 
operators, car drivers), handlers (e.g. unit clerks 
and managers, admissions and billing clerks), in- 
ternal processors (e.g. key punch operators, chart 
analysts, file clerks) and external processors (e.g. 
services for transcription, subpoenas, photocopy, 
microfilm, data processing, coding, and off-site 
storage). 

The identification of legitimate investigators 
poses special problems. Law-enforcement officers, 
for example, sometimes are seen as authority 
figures and obtain unauthorized information from 
personnel who are uninformed or somewhat intimi- 
dated. Newspaper reporters, credit investigators 
and a variety of others without any legitimate need- 
to-know have been known to assume an almost 
limitless range of identities, including patient rela- 
tives, priests, messengers, and physicians, in order 
to obtain health information. 

In an adequate information control system, 
identification of categories of authorized processors 
must be followed by clear identification of persons 
appropriate to perform such functions. Physical, 
technical and procedural security measures are 
developed with a degree of refinement dependent 
to some extent on the adequacies of the personnel 
control system. None of these controls have been 



329 



sufficiently expanded to reflect record-keeping 
practices in today's society. 

The emergence of the computer's role in the 
health care system increases the capacity for in- 
formation storage and transfer and provides a 
new range of possibilities for unauthorized access 
to patient data. The image of giant and possibly 
unrestrained mechanical data banks has, however, 
captured a sufficient number of imaginations to 
result in several studies, publications and legislative 
proposals designed to assess and minimize the 
risks associated with automated record-keeping. 
What has not yet occurred is the translation of 
these concerns to the manual system. Both manual 
and computer systems face such risks as: un- 
trained generators, processors or accessors who 
can inadvertently alter, release or lose informa- 
tion; natural forces such as fire or flood which can 
destroy any information improperly stored; use 
of information for purposes not specified at the 
time of consent to release; and information trans- 
ferred or sold with malicious intent. 

Few data processing policies and procedures are 
comprehensive, detailed, and applicable to all 
forms of processing. Operational standards usually 
are designed in accordance with those of other 
health-care facilities, whereas the best models are 
more likely to be found within high-risk industries. 
Standards devoted to protection of software — the 
record — rarely approach the caliber of those de- 
veloped for the testing of expensive hardware. If 
such deficiencies are corrected, the computer may 
yet prove the greatest asset to confidentiality rather 
than the greatest liability. 



V. Emergence of Privacy as a 
Public Issue 

In the wake of the Watergate revelations, per- 
haps no issue has generated more attention than 
that of privacy. The Privacy Act of 1974 imposed 
controls on the Federal sector with regard to 
record-keeping on individuals and specified rights 
of individuals to gain access to those .ecords main- 
tained by governmental agencies, with the oppor- 
tunity to correct inaccurate data. 

The Privacy Act of 1974 also created the 
Privacy Protection Study Commission, with a man- 
date to undertake a study over a three-year period 
to investigate the feasibility of extending provisions 
of the Privacy Act to the private sector. The Com- 
mission has investigated the record-keeping prac- 
tices in many areas of the private sector, including 



medical records, employment and personnel 
records, education records, records of social 
agencies, and private investigation firms. The re- 
port and recommendations of the Privacy Protec- 
tion Study Commission were transmitted to Presi- 
dent Carter and the Congress on July 12, 1977. 
This report. Personal Privacy in an Information 
Society, includes a chapter titled "Record Keeping 
in the Medical-Care Relationship," which sum- 
marizes information gathered in hearing testimony 
and research, and delineates the conclusions and 
recommendations of the Commission with regard 
to medical documentation. 

The Commission conclusions indicate that 
medical records now contain more information, 
are available to more users, are less well controlled 
and are used for more non-medical purposes than 
ever before. Further, the Commission concludes 
that, in many instances, patient authorization to 
release information may not be consent freely 
given, when the patient's choice may be to consent 
or to forego employment, insurance or other bene- 
fits. In addition, despite the increasing number of 
uses and users of a growing volume of patient 
health information, it is still rare for the patient 
to exercise his right to direct access, to have the 
opportunity to review it for completeness, accuracy 
or timeliness or to control the disclosure of in- 
formation. 

The Commission recommendations have three 
stated objectives: "... (1) to minimize intrusive- 
ness; (2) to maximize fairness; and (3) to create a 
legitimate, enforceable expectation of confidential- 
ity."! 

In a separate study, Computers, Health Records 
and Citizen Rights, conducted under the auspices 
of the Institute for Computer Sciences of the Na- 
tional Bureau of Standards, Alan Westin of the 
Department of Public Law and Government at 
Columbia University has stated that "Medical 
records and health data are being used today in an 
enormous variety of settings, with computerization 
present in all of them. Our report has traced such 
use in doctor's offices, clinics, health centers, and 
hospitals, in governmental and private facilities; 
in acute and ambulatory care; in physical medicine 
and psychiatric treatment; where patients could 
choose their health care and where they are under 
various institutional controls (prisons, the army, 

1 . Personal Privacy in an Information Society: The 
Report of the Privacy Protection Study Commission, 
July 1977, USGPO, Wash., D.C. 20402 stock #052- 
003-00395-3) 



330 



mental hospitals, etc.). We have seen that beyond 
primary care lie important uses of personal medical 
data for service-payment, quality care review, and 
all the social processes . . . from credit, employ- 
ment and licensing to law enforcement, social re- 
search, and political life."^ 

The Westin report is a comprehensive review of 
the nearly infinite ways that personal health infor- 
mation is used, by both appropriate and unauthor- 
ized users, for legitimate, questionable and clearly 
inappropriate purposes, for transactions in the best 
interest of the patient, as well as for those which 
are detrimental to the patient and others. 

The medical record practitioner, as "custodian 
of the records" is increasingly on the horns of a 
dilemma: how to fulfill the obligations of record- 
keeping in providing needed information to serve 
the patient, the health care facility, and the com- 
munity, while protecting the patient from unautho- 
rized, inappropriate or unnecessary intrusion into 
the highly sensitive and personal data of his health 
record. 

Under the watchword of accountability, the 
long-held tradition of confidentiality of health in- 
formation has been gradually eroded. Third party 
payors, both private and governmental, demand 
more and more personal health information to 
process a claim, and routinely visit hospitals to 
review selected patient health records in toto for 
the purposes of claim verification and audit. 

The proposed procedures for Review of Hospital 
Services for Professional Standards Review Or- 
ganizations (Federal Register, January 25, 1977, 
Part II), state in section 101.715 Examination of 
the operation and records of hospitals, that "(a) 
Each PSRO is authorized to inspect the operation 
and records pertinent to the health care services 
rendered to Title V, XVIII or XIX patients of any 
hospital in the PSRO area in which services are 
provided and may require such hospital to provide 
copies of such records to the PSRO. . ."; further, 
this section states that, "(b) a PSRO may utilize 
the records of patients other than those covered 
under Titles XV III, XIX and V, where access to 
their records is authorized by the hospital." 
(emphasis added) Not only have patients who ac- 
cept benefits under these programs relinquished 
their rights to privacy of their health records as a 

2. Westin, Alan F., Computers. Health Records and 
Citizen Rights, U.S. Department of Commerce; Na- 
tional Bureau of Standards Monograph 157, USGPO, 
Wash., D.C. December 1976. 



condition of acceptance of benefits, but it would 
now appear that all patients, regardless of their 
payment status, may have their "confidential" 
health records open to review without the benefit 
of their knowledge or consent. 

The increasing pressures of fiscal accountability, 
malpractice, risk management, accrediting, li- 
censing and regulatory agencies, public health 
agencies and third party payors, with their ac- 
companying information requirements, have sub- 
jected hospitals, and medical record departments 
in particular, to demands for patient health infor- 
mation which are staggering. While the work load 
has increased considerably, employment of suf- 
ficient manpower has been prohibited by fiscal 
constraints facing hospitals. Therefore, medical 
record departments have made heavy use of 
photocopy equipment and other document repli- 
cation media which decrease the effectiveness of 
control over the types and amount of information 
released from patient records. 

Health care facilities have also turned to auto- 
mated information handling systems in an attempt 
to cope with the growing demands for more in- 
formation in more sophisticated formats. The re- 
cipients of this information have turned to such 
electronic systems as well, in order to process and 
review the data received, e.g., the massive data 
systems of Blue Cross/Blue Shield, Medicare, De- 
partments of Welfare, private insurance carriers, 
and most recently, the PSRO's. The technology 
that has evolved to manage the "health informa- 
tion explosion" has, in turn, created new problems 
of data security. 

In his conclusion to Computers, Health Records 
and Citizen Rights, Alan Westin states, "As Ameri- 
can society redefines and reorganizes its health- 
care system in the coming decade, it will have to 
make increased use of computer technology to 
manage the rivers of data that will be generated 
... If the question is not whether but how such 
technology will be used in health care, American 
Society has one nonnegotiable condition for this 
process: basic citizen rights cannot be made a 
casualty of technology-assisted health systems. To 
do so would be to betray the tradition of Hip- 
pocrates, and ultimately to dehumanize health care 
itself." 

The health care community has been acutely 
aware of the insidious erosion of the confidential 
relationship between the patient and the health 
care professional through the growing requests for 



9 



331 



the information shared in this relationship for the 
purpose of patient care. 

The health care community has taken some 
steps to try to curb this intrusion, and momentum 
is gathering for more definitive action. In 1973, the 
American Hospital Association adopted "A 
Patient's Bill of Rights," which included statements 
asserting the patient's rights to privacy of his 
medical care program as well as of all communi- 
cations and records of his care. In 1974, AMRA 
adopted a Position Paper on the Confidentiality of 
Medical Information, recommending the "develop- 
ment and implementation of programs to: (1) pro- 
tect the patient from invasion of privacy as a 
result of indiscriminate and unauthorized access to 
confidential health information and (2) promote 
appropriate use of medical information once it is 
disseminated to authorized persons." Also in 1974. 
at the initiation of the American Psychiatric As- 
sociation, fifty medical and consumer groups met 
in Key Biscayne, Florida, to discuss their concerns 
about the confidentiality of health records. This 
meeting provided the impetus for the formation 
of National Commission on Confidentiality of 
Health Records. In June, 1976 the AM A House of 
Delegates approved a bill for model state legisla- 
tion on the confidentiality of health care infor- 
mation. 

These are but a few examples of expressions of 
concern from the health care community. Most 
of these expressions have been in the form of guide- 
lines or policy statements, without the force of 
law. A version of the AMA Model bill has been 
introduced in five state legislatures; however, it 
has not yet been enacted in any state. 

As these guidelines and policy statements have 
been propounded, the requirements for release of 
patient health information have continued to grow, 
both through regulation and through the require- 
ments of private agencies. Integral to the concerns 
of privacy and confidentiality of patient health in- 
formation is the issue of patient authorization and 
the conditions under which a patient consents to 
release of information from his health record. At 
this time, it is unusual for a patient to gain direct 
access to his health record. Without the oppor- 
tunity to review the contents of his health record, 
a patient is placed in the untenable position of 
consenting to the release of information of which 
the patient has no knowledge. This situation is 
incompatible with the rationale of informed con- 
sent. Further, many patients sign blanket prospec- 



tive consents to release of medical information as 
a condition of participation in both private and 
public health insurance programs. Here, again, 
the patient is required to consent to the release of 
information which does not yet exist, and there- 
fore, cannot be considered informed consent. 

The public has been increasingly subjected to 
intrusion by a variety of agencies into their per- 
sonal lives; in recent years, the greatest intrusion 
into the "medical life" of the individual has been 
made in the name of accountability. The public 
has demanded this, too; however, the public at 
large does not recognize the consequences of these 
demands nor the price in individual freedom and 
privacy that is paid to assure that health dollars 
are spent most appropriately and most effectively. 
In addition, those who have been pressed to be 
accountable, have, in some cases, been overzealous 
in carrying out their charge, and have demanded 
far more information than necessary to process a 
claim, to determine eligibility, or to assure 
quality. 

There is now a need for a swing of the pendulum 
back, for a balance between the needs of society 
to know and the rights of the individual to be free 
from unwarranted intrusion into his personal life. 
AMRA acknowledges the need for patient health 
information in substantiating health insurance 
claims, in litigation, and in medical care evalu- 
ation. The critical issue is how much information 
is needed to carry out these functions, under what 
conditions should the information be gathered and 
disseminated, who should have access to the in- 
formation and what criteria should be used to 
determine legitimacy of purpose. 

Many of these questions become moot if the 
patient is fully informed about the existence of 
information about his health care, has access to it 
and can exercise maximum control over its dis- 
semination. In the spirit of this philosophy, AMRA 
endorses the following model policies for main- 
tenance of confidentiality of health information, 
and actively supports their implementation. 

Model Policies for Maintenance 
of Confidentiality of Patient 
Health Information 

General 

The health record is the property of the health 
facility and shall be maintained to serve the 
patient, the health care providers and the institu- 



10 



56-421 O 



80 



22 



332 



tion in accordance with legal, accrediting and 
regulatory agency requirements. The information 
contained in the health record belongs to the 
patient, and the patient is entitled to the protected 
right of information. All patient care information 
shall be regarded as confidential and available only 
to authorized users. 

1.0 Data Collection 

1.1 The types and amount of information 
gathered and recorded about a patient shall be 
limited to that information needed for patient care. 
Supplementary data which is not required for 
patient care but desirable for research, education, 
etc., may be recorded with the permission of the 
patient, following explanation of the purpose for 
which the information is requested. 

1.2 All individuals engaged in the collection, 
handling or dissemination of patient health infor- 
mation shall be specifically informed of their re- 
sponsibility to protect patient data and of the pen- 
alty for violation of this trust. Proven violation of 
confidentiality of patient information shall be cause 
for immediate termination of access to further 
data, and immediate termination of any employer- 
employee relationship with prejudge for rehire. 
This policy shall be made known to all employees 
at the time of employment and each employee shall 
indicate understanding of this policy through a 
signed statement at the time of employment, kept 
with employee's personnel record. An example of 
statement is attached. Once yearly they will read 
the policy and again sign a statement of compli- 
ance and understanding. 

Note: Continued development of State and 
Federal legislation to impose penalties of fine 
and/or imprisonment for such violation is recom- 
mended. 

1.3 The collection of any data relative to a 
patient, whether by interview, observation or re- 
view of documents, shall be conducted in a setting 
which provides maximum privacy and protects the 
information from unauthorized individuals. 

2.0 Storage 

2.1 All primary health records shall be housed 
in physically secure areas under the immediate 
control of the Director of the Medical Record 
Department. 

2.2 Secondary records, indices or other indi- 
vidually identifiable patient health information 
maintained by the institution are subject to the 
stated policies for maintenance of confidentiality 
of patient health information. A listing of these 



secondary records with a brief description of con- 
tent and location shall be maintained in a central 
location, preferably in the Medical Record Depart- 
ment. 

2.3 Primary and secondary health records shall 
be retained according to legal, accrediting or regu- 
latory agency requirements, then destroyed ac- 
cording to an approved institutional retention 
schedule unless there is specific need for preserva- 
tion of these records. The method of destruction 
shall be specified and the actual destruction wit- 
nessed or attested to in writing by the individual(s) 
responsible for destruction. 

2.4 Original health records may not be removed 
from the premises, except on order of subpoena. 

2.5 Access to areas housing health information 
records shall be limited to Medical Record De- 
partment personnel. The sole exception to this 
policy shall be the individual designated by the 
Director of Medical Records for access at times 
when the Department is not staffed. Health records 
must be available and accessible at all times for 

patient care. 

2.6 When in use within the institution, health 
records should be kept in secure areas at all times. 
Health records should not be left unattended in 
areas accessible to unauthorized individuals. 

2.7 If facsimilies of the health record are pro- 
vided to authorized internal users, the same con- 
trols will be applied for return of these facsimilies 
as for return of the original health record. 
Wherever possible, internal users will be encour- 
aged to use the original health record rather than 
to obtain a facsimile. 

2.8 When photocopies or other reproductions 
of the health record are provided to authorized 
external users, these copies will be accompanied 
by a statement: 

a) prohibiting use of the information for other 
than the stated purpose. 

b) prohibiting disclosure by recipient to any 
other party. 

c) requiring destruction of copies after the 
stated need has been fulfilled. 

3.0 Access. 

3.1 All requests for health records shall be 
directed to the Medical Record Department. 

3.2 Release of information from the health 
record shall be carried out in accordance with all 
applicable legal, accrediting, regulatory agency re- 
quirements, and in accordance with written insti- 
tutional policy. 



333 



3.3 Health records shall be available for use 
within the facility for direct patient care by all 
authorized personnel as specified by the chief 
executive officer, and documented in a policy 
manual. 

3.4 Direct access to patient health records for 
routine administrative functions, including billing, 
shall not be permitted, except where the employees 
are instructed in policies on confidentiality and 
subject to penalties arising from violation of these 
as specified in 1.2. 

3.5 Original health records may not be removed 
from the premises, except on order of subpoena. 

3.6 Subject only to specific contraindications by 
the attending physician and to any legal constraints 
such as those governing minors and those adjudi- 
cated as incompetent, a patient may have access to 
his own health record for review upon written 
request with reasonable notice. A patient may have 
access to records of his care after discharge and 
completion of the health record. Photocopies of 
health record will be provided on written request 
by the patient and payment of a reasonable fee. 

3.7 All information contained in the health 
record is confidential and the release of informa- 
tion will be closely controlled. A properly com- 
pleted and signed authorization is required for re- 
lease of all health information except: 

a) as required by law 

b) for release to another health care provider 
currently involved in the care of the patient 

c) for medical care evaluation 

d) for research and education in accordance 
with conditions specified in Policies 3.11 and 
3.12 below. 

3.8 In keeping with the tenet of informed con- 
sent, a properly completed and signed authoriza- 
tion to release patient information shall include at 
least the following data: 

a) name of institution that is to release the in- 
formation 

b) name of individual or institution that is to 
receive the information 

c) patient's full name, address and date of birth 

d) purpose or need for information 

e) extent or nature of information to be re- 
leased, including inclusive dates of treatment 

Note: An authorization specifying "any and 
all information . . ." shall not be honored 

f) specific date, event or condition upon which 
consent will expire unless revoked earlier 

g) statement that consent can be revoked but 



not retroactive to the release of information 

made in good faith 
h) date that consent is signed 

Note: Date of signature must be later than 

the dates of information to be released 
i) signature of patient or legal representative. 

3.9 All requests for information from health 
records shall be directed to the Medical Record 
Department for processing. 

3.10 Information released to authorized indi- 
viduals/agencies shall be strictly limited to that 
information required to fulfill the purpose stated 
on the authorization. Authorizations specifying 
"any and all information . . ." or other such broad- 
ly inclusive statements shall not be honored. Re- 
lease of information that is not essential to the 
stated purpose of the request, is specifically pro- 
hibited. 

3.11 Following authorized release of patient 
information, the signed authorization will be re- 
tained in the health record with notation of what 
specific information was released, the date of re- 
lease and the signature of the individual who re- 
leased the information. 

3.12 Health records shall be available to auth- 
orized students enrolled in educational programs 
affiliated with the institution for use within the 
Medical Record Department. Students must pre- 
sent proper identification and written permission 
of the instructor with their request. Data compiled 
in educational studies may not include patient 
identity or other information which could identify 
the patient. 

3.13 Health records shall be made available for 
research to individuals who have obtained ap- 
proval for their research projects from the appro- 
priate medical staff committee and administrator 
or other designated authority. Data compiled as 
part of research studies may not include patient 
identity or other information which could identify 
the patient unless prior authorization from the 
patient has been obtained. Any research project 
which would involve contact of the patient by 
the researcher must have written permission of 
the patient's attending physician, or in his absence 
a physician designated by the current chief execu- 
tive officer of the facility, and consent of the chief 
executive officer to conduct this study prior to con- 
tact. Research projects which involve use of 
health records shall be conducted in accordance 
with institutional policies on use of health records 
for research. 



12 



334 



3.14 The names, addresses, dates of admission 
or discharge of patients shall not be released to 
the news media or commercial organizations 
without the express written consent of the patient 
or his authorized agent. 

3.15 All service organizations which process 
patient-identifiable health information for the in- 
stitution shall agree in writing to conditions which: 

a) mandate the security of the patient informa- 
tion, 

b) specify the methods by which the informa- 
tion is handled and transported, 



c) limit the number of types of individuals who 
have access to the information to those 
directly involved in processing and 

d) specify the penalty for any violation of 
security or confidentiality. 

3.16 Requests for health record information re- 
ceived via telephone will require proper identifi- 
cation and verification to assure that the requesting 
party is entitled to receive such information. A 
record of the request and information released 
will be kept. ■ 



SAMPLE CONFIDENTIALITY STATEMENT 



I understand and agree that in the performance of my duties as an employee 

of , I must hold 

medical information in confidence. Further I understand, that intentional or 
involuntary violation of my employer's confidentiality may result in punitive 
action including possible fine or imprisonment. 



Date 



Date 



Date 



Date 



Signature 



Signature 



Signature 



Signature 



13 



335 




AMERICAN 

MEDICAL 
RECORD 

ASSOCIATION 



875 NORTH MICHIGAN AVENUE • SUITE 1850, JOHN HANCOCK CENTER. CHICAGO. ILLINOIS 60611 | (312) 787-2672 

EXECUTIVE OFFICE 



May 22. 1979 



The Honorable Richardson Preyer 

Chairman 

Government Information and Individual 

Rights Subcommittee of the Committee 

on Government Operations 
Raybum House Office Building 
Room B-3A9-B-C 
Washington, D.C. 20515 

Dear Congressman Preyer: 

On behalf of the American Medical Record Association I wish to thank you and the 
Subcommittee for your recent invitation to us to testify on confidentiality of 
medical records. Per your request, enclosed is the transcript of the hearings 
from April 9, 1979 and our comments and signature. 

Your letter of April 21, 1979 requested assistance on compiling an up-to-date list 
of statutes on confidentiality of medical records from various state statutes and 
a record of any statistics which we have on patient access and correction procedures 
for medical records. At this time we are in the process of gathering these materials 
and statistics for the hearing record and will forward them to the Subcommittee as 
soon as they are available to us. You also requested that we provide detailed 
comments on the HR 2979 and HR 3A44. The AMRA Advisory Panel on Confidentiality 
will provide a detailed commentary on these bills in the near future. We will 
forward these comments as you requested. 

Again, I th«nk you and the Subcommittee for your interest in the subject of 
confidentiality of medical records and for your communication with the American 
Medical Record Association. I look forward to continued work with you and the 
Subcommittee staff. 



9" 



Sincerely , ^ 

Jane Rogers, RRA 
Director of Legislative Affairs 
and Communications 

JR:lm 

cc: Carolyn Cave, Ph.D., RRA cc: Lorraine Volz, RRA 

Executive Director 

American Medical Record Association 



336 

Mr. Drinan. Thank you, Ms. Rogers and Ms. Volz, for your 
presentation. 
Ms. Volz. Thank you for inviting us. 
[Ms. Rogers' prepared statement follows:] 




AMERIO\N 

MEDICAL 
RECORD 

AS.^DCIAT10N 



.'ORTH MICHIGAN AV-'JUE • SUITE 1850. JOHN HANCOCK CENTER. CHICAGO, ILLINOIS 60611 | (312) 787-2672 

EXECUTIVE OFFICE 



U.S. HOUSE OF REPRESENTATIVES 

COMMITTEE ON GOVERNMENT OPERATIONS 

SUBCOMMITTEE ON GOVERNMENT INFORMATION AND INDIVIDUAL RIGHTS 



Written Testimony 

submitted by the 

American Medical Record Association 

Concerning 

Confidentiality of Medical Records 



337 

THE AMERICAN MEDICAL RECORD ASSOCIATION 

I AM JANE ROGERS, R.R.A., DIRECTOR OF LEGISLATIVE AFFAIRS AND 
COMMUNICATIONS FOR THE AMERICAN MEDICAL RECORD ASSOCIATION (AMRA) . AN ORGANI- 
ZATION REPRESENTING MORE THAN 22,000 REGISTERED RECORD ADMINISTRATORS, 
ACCREDITED RECORD TECHNICIANS. AND OTHERS INTERESTED IN MEDICAL RECORDS 
AND HEALTH DATA. THE PRIMARY PURPOSE OF THE ASSOCIATION IS TO PROMOTE COMPRE- 
HENSIVE HEALTH RECORD SERVICES FOR THE WELFARE OF THE PUBLIC. 

ONE OF THE GOALS RELATES DIRECTLY TO THE CONCERNS OF THE SUBCOM- 
MITTEE. THIS AMRA GOAL IS TO PROVIDE LEADERSHIP IN PROMOTING APPROPRIATE 
USE OF HEALTH RECORD INFORMATION IN THE BEST INTERESTS OF THE PUBLIC. THE 
MEDICAL RECORD PRACTITIONER HAS AN OBLIGATION TO PROTECT THE INDIVIDUAL'S 
RIGHT OF PRIVACY WITH RESPECT TO THE CONTENT OF HIS MEDICAL RECORD AND TO 
ASSIST HIM IN UNDERSTANDING THE RELEASE OF APPROPRIATE INFORMATION FROM HIS 
MEDICAL RECORD EITHER TO FACILITATE HIS CONTINUING HEALTH CARE OR TO ENABLE 
HIM TO SECURE PAYMENT FOR HIS CARE FROM THIRD PARTY PAYORS. 

THE AMERICAN MEDICAL RECORD ASSOCIATION SETS STANDARDS FOR MEDICAL 
RECORD PRACTITIONERS, AND PROVIDES FOR CREDENTIALIN6 OF PRACTITIONERS. THE 
EDUCATIONAL PROGRAMS OFFERED TO PREPARE FOR ENTERING MEDICAL RECORD PRACTICE 
ARE APPROVED ON THE BASIS OF STANDARDS DEVELOPED JOINTLY WITH THE AMERICAN 
MEDICAL ASSOCIATION. PROOF OF PARTICIPATION IN A CONTINUING EDUCATION PRO- 
GRAM IS REQUIRED FOR MAINTENANCE OF CREDENTIALS TO PRACTICE. THE ASSOCIATION 
PROVIDES A VARIETY OF CONTINUING EDUCATION PROGRAMS FOR ITS MEMBERS. 

I APPRECIATE THE OPPORTUNITY AFFORDED BY THIS COMMISSION TO PROVIDE 
INFORMATION ABOUT CONFIDENTIALITY AND MEDICAL RECORD PRACTICES AND PROBLEMS 
AS PERCEIVED BY THE MEDICAL RECORD PROFESSION. 



338 



PURPOSE AND USE OF MEDICAL RECORD 

THE CONCEPT OF "CONFIDENTIALITY" OF MEDICAL INFORMATION IS A MEDICAL 
TRADITION AS OLD AS THE HIPPOCRATIC OATH - INFORMATION EXCHANGED BETK£EN 
PATIENT AND PHYSICIAN IS SACRED, PRIVATE, CONFIDENTIAL. IT IS AN ASSUMPTION 
HELD BY ALL HEALTH CARE PROFESSIONALS. HISTORICALLY, THE PRIMARY PURPOSE 
OF THE MEDICAL RECORD HAS BEEN THE CARE OF THE PATIENT - TO DOCUMENT THE 
CAUSE OF HEALTH CARE AND TO PROVIDE A MEDIUM OF COMMUNICATION AMONG HEALTH 
CARE PROFESSIONALS. ENTRIES ARE MADE IN THE MEDICAL RECORD NOT ONLY BY 
PHYSICIANS, BUT NURSES, DIETICIANS, SOCIAL WORKERS, PHARMACISTS, PHYSICAL 
THERAPISTS AND MANY OTHER SPECIALISTS. 

IN RECENT YEARS, HOWEVER, OUR SOCIETY HAS SEEN CHANGES IN THE DE- 
LIVERY, PAYMENT, AND ACCOUNTABILITY MECHANISMS OF THE HEALTH CARE SYSTEM, 
WHICH HAVE SUBJECTED HEALTH FACILITIES, AND MEDICAL RECORD DEPARTMENTS, 
IN PARTICULAR, TO STAGGERING DEMANDS FOR MEDICAL INFORMATION. YOU MAY 
NOW ASSUME THAT MEDICAL RECORDS ARE USED ONLY FOR PATIENT CARE - BUT JUST 
LISTEN TO THE POTENTIAL SECONDARY USERS: 

1) PAYORS FOR SEVICES, PRIVATE AND GOVERNMENT INSURANCE PLANS 
AND PROGRAMS. 

2) PUBLIC HEALTH AGENCIES, 

3) MEDICAL AND SOCIAL RESEARCHERS, 

4) REHABILITATION AND SOCIAL WELFARE PROGRAMS, 

5) EMPLOYERS, 

6) INSURANCE COMPANIES, 

7) GOVERNMENT AGENCIES, 

8) EDUCATIONAL INSTITUTIONS, 

9) JUDICIAL PROCESSES, 

10) LAW ENFORCEMENT AND INVESTIGATION, 



339 



11) CREDIT INVESTIGATION AGENCIES, 
AND FINALLY, 

12) ACCREDITING, LICENSING AND CERTIFYING AGENCIES. 

AS MORE KNOWLEDGE HAS DEVELOPED ABOUT THE IMPACT OF SOCIAL, EMO- 
TIONAL, AND ECONOMIC FACTORS ON MEDICAL CONDITIONS, MORE INFORMATION HAS 
BEEN SOUGHT AND RECORDED IN THE RECORD ABOUT THE INDIVIDUAL'S FAMILY, 
SCHOOL, OR WORK SITUATION, AS WELL AS HIS ECONOMIC WELL BEING AND ANY 
ENVIRONMENTAL FACTORS THAT MIGHT HAVE BEARING ON HIS HEALTH STATUS. 

TODAY A COMPLETE MEDICAL RECORD MAY CONTAIN MORE INTIMATE DETAILS 
ABOUT AN INDIVIDUAL THAN COULD BE FOUND IN ANY OTHER SINGLE DOCUMENT. 
MEDICAL RECORDS MAINTAINED IN HOSPITALS AND OTHER MEDICAL CARE SETTINGS 
ARE NOT GENERALLY RECORDS OF SINGLE EPISODES OF ILLNESS: RATHER THEY ARE 
COMPILATIONS IN A SINGLE RECORD OF ALL EXAMINATION AND/OR TREATMENT EPI- 
SODES IN AN INDIVIDUAL'S CONTACT WITH THAT INSTITUTION OVER TIME, WHICH 
CAN ENCOMPASS MANY YEARS OR EVEN A LIFETIME. IT IS FOR THIS REASON THAT 
THE PRESERVATION OF THE CONFIDENTIALITY OF THIS INFORMATION AND PROTECTION 
AGAINST ITS IMPROPER USE IS SO IMPORTANT TO THE INDIVIDUAL'S CIVIL RIGHTS. 



340 



CONTENT OF RECORD AND DOCUMENTATION STANDARDS 

CURRENT DOCUMENTATION STANDARDS REQUIRE THAT MEDICAL RECORDS CON- 
TAIN SUFFICIENT INFORMATION TO IDENTIFY THE PATIENT, TO SUPPORT THE DIAGNO- 
SIS, TO JUSTIFY THE TREATMENT, AND TO DOCUMENT THE RESULTS ACCURATELY. 

A TYPICAL HOSPITAL MEDICAL RECORD INCLUDES THE PATIENT'S NAME, 
ADDRESS, AGE, NEXT OF KIN, NAMES OF PARENTS, DATE AND PLACE OF BIRTH, MARI- 
TAL STATUS, RELIGION, MILITARY SERVICE, SOCIAL SECURITY OR MEDICARE NUMBER, 
SOURCE OF REIMBURSEMENT COVERAGE (INSURANCE OR GOVERNMENTAL), AND THE IDENTI- 
FICATION NUMBER ASSIGNED BY THE HOSPITAL. 

THE MEDICAL HISTORY INCLUDES THE CHIEF COMPLAINT, DETAILS OF PRESENT 
ILLNESS, PAST MEDICAL, SOCIAL AND FAMILY HISTORIES, PREVIOUS TREATMENT, 
AN INVENTORY OF HISTORY RELATED TO EACH BODY SYSTEM, MEDICATIONS TAKEN 
IN THE PAST AND AT PRESENT, USE OF ALCOHOL AND TOBACCO, PRENATAL HISTORY IF 
AN OBSTETRICAL PATIENT, AND THE PROVISIONAL DIA.GNOSIS. 

THE PHYSICAL EXAMINATION RECORD CONTAINS POSITIVE AND NEGATIVE 
FINDINGS OF A COMPREHENSIVE CURRENT PHYSICAL ASSESSMENT AND A PRELIMINARY 
DIAGNOSIS. 

THE RECORD CONTAINS BY DATE AND IDENTIFICATION OF THE RECORDER, 
ALL FINDINGS OF DIAGNOSTIC TESTS ADMINISTERED, CONSULTATIONS SOUGHT AND 
RENDERED, ALL ORDERS FOR MEDICATIONS AND TREATMENTS, ALL TREATMENTS PROVIDED, 
DRUGS ADMINISTERED, FINDINGS, OBSERVATIONS, PROGRESS, REACTIONS OR INCIDENTS. 
FINALLY, THERE IS A COMPREHENSIVE SUMMARY WRITTEN AT THE TIME OF DISCHARGE. 

STANDARDS FOR MEDICAL. RECORDS ARE ESTABLISHED AND ENFORCED BY THE 
JOINT COMMISSION ON THE ACCREDITATION OF HOSPITALS AND BY DHEW FOR FEDERAL 
HEALTH PROGRAMS. 



341 



CONTENT OF RECORDS - AFFECT OF NON-MEDICAL USES 

THE AMOUNT OF DETAIL RECORDED IN THE MEDICAL RECORD MAY BE AFFECTED 
BY THE KNOWLEDGE ON THE PART OF THE PATIENT, MEMBERS OF THE FAMILY, OR THE 
PHYSICIAN AND OTHER HEALTH CARE PRACTITIONERS ABOUT ITS POSSIBLE USES. 

PATIENTS WHO ARE AWARE THAT THE INFORMATION IN THE RECORD MAY BE 
AVAILABLE TO THIRD PARTY PAYORS, ATTORNEYS, EMPLOYERS, LIFE INSURANCE COMPANIES 
OR OTHERS MAY WITHHOLD CERTAIN INFORMATION THAT HE BELIEVES CAN BE USED 
AGAINST HIM OR THAT HE CONSIDERS TO BE OF SUCH A PERSONAL NATURE THAT ITS 
DISCLOSURE MIGHT BE EMBARRASSING. SIMILARLY, MEMBERS OF THE PATIENT'S 
FAMILY MAY NOT WISH TO MAKE FULL DISCLOSURE FOR THE SAME REASONS. THIS 
IS PARTICULARLY TRUE WITH REGARD TO FAMILY HISTORY, INTERPERSONAL PROBLEMS, 
USE OF ALCOHOL AND DRUGS, AND SIMILAR QUESTIONS THAT MAY BE ASKED ABOUT 
IN CONNECTION WITH A POSSIBLE MENTAL ILLNESS. THIS SITUATION IS OF GROWING 
CONCERN TO PHYSICIANS WHO FEAR THAT THE DEMANDS FOR MEDICAL INFORMATION FOR 
PURPOSES OTHER THAN CARE OF THE PATIENT HAS RESULTED IN CONCEALMENT OF IMPOR- 
TANT INFORMATION HAVING DIRECT BEARING ON THEIR ABILITY TO DIAGNOSE AND 
TREAT THE PATIENT. 

RELEVANT TO THE SECONDARY USERS CITED PREVIOUSLY, INCREASED DIS- 
SEMINATION OF MEDICAL RECORDS AND INFORMATION, EVEN THOUGH MOST INFORMATION 
IS RELEASED WITH CONSENT OF THE PATIENT, HAS RESULTED IN ABUSES OF CONFI- 
DENTIALITY AND THE EMERGENCE OF PRIVACY AS A PUBLIC ISSUE. THE PRIVACY 
ACT PASSED BY CONGRESS IN 1974 CREATED THE PRIVACY PROTECTION STUDY COMMIS- 
SION. THE COMMISSION REPORT RELATIVE TO MEDICAL RECORDS CONCLUDED THAT 
"MEDICAL RECORDS CONTAIN MORE INFORMATION, ARE MORE AVAILABLE TO MORE 
USERS, ARE LESS WELL-CONTROLLED AND ARE USED FOR MORE NON-MEDICAL PURPOSES 
THAN EVER BEFORE." THIS REPORT WAS SUBMITTED IN JULY 1977 - AND I ASSURE 



342 



YOU THAT THE CONDITIONS RELEVANT TO MEDICAL RECORD PRIVACY HAVE ONLY INTEN- 
SIFIED SINCE THEN. 

CASES OF ABUSE RESULTING FROM ACCESS TO MEDICAL RECORDS AND MEDICAL 
INFORMATION ARE WELL-DOCUMENTED. PERHAPS THE BEST KNOWN CRIMINAL CASES ARE 
THE ELLSBERG CASE AND THE RECENT DENVER CASE, IN WHICH PRIVATE INVESTIGATIVE 
FIRMS HIRED BY INSURANCE COMPANIES POSED AS MEDICAL PROFESSIONALS AND OB- 
TAINED MEDICAL RECORDS UNDER FALSE PRETENSES FROM HOSPITALS. OTHER SAMPLE 
CASES OF MISUSE OR MIS-HANDLING OF MEDICAL INFORMATION INCLUDES TRANSFER 
OF DIAGNOSES FROM THE INSURANCE COMPANY TO PATIENTS' EMPLOYERS, TRANSFER 
OF INFORMATION ON A HUSBAND OR WIFE WHO HAS BEEN A PATIENT VIA THE INSURANCE 
COMPANY AND/OR EMPLOYER, LINKAGE OF MEDICAL WITH NON-MEDICAL COMPUTER FILES 
IN THE NAME OF RESEARCH, USE OF MEDICAL INFORMATION IN DENYING INSURANCE, 
EMPLOYMENT, AND SO ON. 



343 



PATIENT ACCESS AND RECORD CORRECTION 

THE PRIVACY COMMISSION REPORT STATES TWO IMPORTANT CONCLUSIONS 
REGARDING PATIENT ACCESS AND AUTHORIZATION FOR RELEASE OF MEDICAL RECORDS. 
FIRST, IN SPITE OF THE INCREASED USES AND USERS OF PATIENT HEALTH INFORMA- 
TION IT IS RARE FOR THE PATIENT TO HAVE DIRECT ACCESS TO MEDICAL INFORMATION 
AND TO REVIEW IT FOR ACCURACY, OR TO CONTROL THE DISCLOSURE OF INFORMATION. 
AND, IN MANY INSTANCES, PATIENT AUTHORIZATION TO RELEASE INFORMATION MAY NOT 
BE CONSENT FREELY GIVEN, WHEN THE PATIENT'S CHOICE MAY BE TO CONSENT OR TO 
FOREGO EMPLOYMENT, INSURANCE, OR OTHER BENEFITS. 

TRADITIONALLY, IT HAS NOT BEEN THE PRACTICE OF HEALTH CARE PROVIDERS 
OR -INSTITUTIONS TO PROVIDE THE PATIENT ACCESS TO THE MEDICAL RECORD ITSELF. 
IN THE LAST FEW YEARS SOME FOURTEEN (14) STATES HAVE MADE STATUTORY PROVISIONS 
FOR SUCH ACCESS. IT HAS BEEN THE PRACTICE TO GIVE VERBAL INFORMATION ABOUT 
FACTS HE SHOULD HAVE OR TO PROVIDE CERTAIN SUMMARY DATA TO THE PATIENT 
AND THESE PRACTICES SEEM LIKELY TO INCREASE WITH THE GROWING RECOGNITION 
OF THE INDIVIDUAL'S RIGHT TO KNOW. 

THE AMERICAN MEDICAL RECORD ASSOCIATION SUPPORTS THE RIGHT OF THE 

PATIENT TO HAVE ACCESS TO HIS MEDICAL RECORD. IN AN ERA WHEN THE MEDICAL 

RECORD IS WIDELY REVIEWED WE BELIEVE THE PATIENT, TOO, DESERVES THIS 

RIGHT AND THAT SUCH A RIGHT IS NECESSARY FOR THE PATIENT TO BE TRULY INFORMED 

WHEN HE SIGNS AN AUTHORIZATION FOR RELEASE OF THE MEDICAL RECORD. AMRA'S 

"MODEL POLICY" ON PATIENT ACCESS READS: 

SUBJECT ONLY TO SPECIFIC CONTRAINDICATIONS BY THE ATTENDING 
PHYSICIAN AND TO ANY LEGAL CONSTRAINTS SUCH AS THOSE GOVERNING 
MINORS AND THOSE ADJUDICATED AS INCOMPETENT, A PATIENT MAY 
HAVE ACCESS TO HIS OWN HEALTH RECORD FOR REVIEW UPON WRITTEN 
REQUEST WITH RESONABLE NOTICE. A PATIENT MAY HAVE ACCESS TO 
■ RECORDS OF HIS CARE AFTER DISCHARGE AND COMPLETION OF THE HEALTH 
RECORD. PHOTOCOPIES OF HEALTH RECORD WILL BE PROVIDED ON WRIT- 
TEN REQUEST BY THE PATIENT AND PAYMENT OF A REASONABLE FEE. 



344 



AS TO THE CONSEQUENCES, NEGATIVE OR POSITIVE, OF PERMITTING PATIENTS 
ACCESS TO THEIR MEDICAL RECORDS, THIS IS ALMOST IMPOSSIBLE TO ASSESS BECAUSE 
OF THE ABSENCE OF ANY BUT THE MOST LIMITED EXPERIENCE. IN STATES WHERE SUCH 
ACCESS IS AUTHORIZED, AND A PATIENT DEMANDED TO SEE HIS RECORD, IT HAS BEEN 
CUSTOMARY TO HAVE THE RECORD REVIEWED IN THE PRESENCE OF A PHYSICIAN. 

CERTAIN LIMITED EXPERIENCES WERE REPORTED AND DISCUSSED IN A MEETING 
ON CONFIDENTIALITY HELD IN 1974. IT WAS CITED THAT REVIEW OF THE RECORD 
BY THE SUBJECT OR MEMBER OF THE FAMILY RESULTED IN STRESS AND TRAUMA ON 
THE PART OF THE REVIEWER. OTHER EXPERIENCES WERE REPORTED AS FAVORABLE, 
WITH THE PATIENT BECOMING MORE COOPERATIVE BECAUSE OF HIS INCREASED UNDER- 
STANDING OF HIS OWN MEDICAL CONDITION. ONE STUDY INVOLVED SHARING THE AD- 
MISSION NOTES AND EVENTUALLY HIS PROBLEM ORIENTED RECORD. IT WAS STATED 
THAT MOST PATIENTS REACTED POSITIVELY, COULD HANDLE THE INFORMATION, AND 
DISCUSSION BETWEEN STAFF AND PATIENT WAS EXPEDITED. THE CONCLUSION WAS 
THAT MEDICAL INFORMATION SHARING IS A TOOL THAT MAY IMPROVE PATIENTS' 
SATISFACTION WITH THEIR CARE. 

STATES IN WHICH PATIENT ACCESS LEGISLATION HAS BEEN PASSED IN RE- 
CENT YEARS, HAVE REPORTED NO GREAT DEMAND FOR RECORDS AS A RESULT. PERHAPS 
THIS IS DUE TO LACK OF INTEREST ON THE PART OF PATIENTS OR PERHAPS PATIENTS 
ARE NOT AWARE THAT THEY MAY HAVE ACCESS. REGARDLESS, WE SUPPORT THE OP- 
PORTUNITY FOR PATIENT ACCESS. 

BECAUSE OF THE EXTREMELY LIMITED EXPERIENCE WITH PERMITTING PATIENTS 
ACCESS TO THEIR RECORDS, IT IS NOT POSSIBLE TO COMMENT ON ITS IMPACT ON 
MALPRACTICE SUITS EITHER FAVORABLY OR UNFAVORABLY. IF SUCH ACCESS WERE 
TO BECOME GENERAL PRACTICE, ONE COULD MAKE CERTAIN GUESSES AS TO THE IMPACT- 
IT IS KNOWN THAT SOME MALPRACTICE SUITS ARE BASED ON ERRONEOUS CONCLUSIONS' 



345 



REACHED BY THE PATIENT THAT WOULD BE CORRECTED BY READING THE ACTUAL RECORD. 
TO THE EXTENT THAT MISINFORMATION IS CORRECTED, SOME MALPRACTICE SUITS 
MIGHT BE PREVENTED. 

ONE CAN ALSO CONCLUDE THAT ADVANCE AWARENESS ON THE PART OF THOSE 
WHO MAKE ENTRIES IN THE RECORD THAT THE PATIENTS MAY READ THE RECORD ON 
REQUEST WILL RESULT IN MORE CAREFUL RECORDING SO THAT MISINTERPRETATIONS CAN 
CE AVOIDED. CERTAINLY, THE RECORDING OF INFORMATION PROVIDED BY THE PATIENT 
WILL BE DONE WITH CARE, AND OPPORTUNITIES AFFORDED FOR OFFICIAL CORRECTION 
OF THIS INFORMATION SHOULD AN ERROR INADVERTENTLY OCCUR. 



346 



CORRECTIONS 

AT PRESENT, CORRECTIONS ARE MADE IN THE RECORD, AS ARE ENTRIES 
THEMSELVES, BY MEMBERS OF THE HEALTH PROFESSIONS, UNDER GUIDELINES ES- 
TABLISHED BY THE INSTITUTION. ALL ENTRIES MUST BE DATED AMD AUTHENTICATED 
BY THE RECORDER. WHEN AN ERROR IS DISCOVERED, IT IS LINED THROUGH AND SIGNED 
BY THE AUTHOR WITH THE CORRECT INFORMATION ADDED. 

PROVISION OF ACCESS AND CORRECTION BY THE RECORD SUBJECT DOES NOT 
GENERALLY VIOLATE THE CONFIDENTIALITY OF THE DOCTOR/PATIENT RELATIONSHIP. 
HOWEVER, IT MUST BE REMEMBERED THAT WHENEVER A PHYSICIAN OR OTHER HEALTH 
PROFESSIONAL OBTAINS CONFIDENTIAL INFORMATION FROM A FAMILY MEMBER OR OTHER 
CONFIDANT AND ENTERS THE INFORMATION IN THE RECORD TO WHICH THE PATIENT HAS 
ACCESS, THERE MAY BE A VIOLATION OF THE CONFIDENTIAL NATURE OF THAT INFORMA- 
TION. THIS IS OF EXTREME IMPORTANCE IN PSYCHIATRIC RECORDS IN WHICH INFOR- 
MATION SECURED FROM OTHERS ABOUT A PATIENT'S BEHAVIOR, FAMILY ATTITUDES, 
AND THE LIKE ARE IMPORTANT TO UNDERSTANDING THE PATIENT'S PROBLEMS BUT 
CAN BE DAMAGING IF DISCLOSED TO THE PATIENT. 

THE EXTENT TO WHICH THE DOCTOR/PATIENT RELATIONS MIGHT BE ALTERED 
IS DIFFICULT TO ASSESS. THERE IS NO AGREEMENT AMONG PHYSICIANS THAT PA- 
TIENT ACCESS TO THE RECORD SHOULD BE PERMITTED. SUCH A PRACTICE IS CON- 
TRARY TO THEIR ENTIRE PROFESSIONAL TRAINING AND EXPERIENCE. THEY BELIEVE 
IT IS THEIR RIGHT AND PRIVILEGE TO INTERPRET TO THE PATIENT AND/OR HIS 
FAMILY WHAT THEY BELIEVE THEY SHOULD KNOW. THERE ARE STRONG VIEWS ABOUT 
THE RIGHT OF THE PATIENT TO HAVE EARLY KNOWLEGE OF CERTAIN OR POTENTIALLY 
FATAL ILLNESS. THIS, MANY PHYSICIANS BELIEVE, IS A MATTER THAT MUST BE 
DETERMINED IN EACH INDIVIDUAL'S SITUATION. 



347 



BECAUSE OF THE ESPECIALLY SENSITIVE NATURE OF CERTAIN KINDS OF RECORDS, 
IT WOULD BE NECESSARY TO ESTABLISH SPECIAL PROCEDURES AND SAFEGUARDS, FOR 
EXAMPLE, RECORDS OF PSYCHIATRIC ILLNESS, ABORTIONS, ALCOHOLISM AMD OTHER 
DRUG ADDICTIONS. 

A PROBLEM CONCERNING ACCESS TO THE MEDICAL RECORDS OF FORMER PATIENTS 
THAT SHOULD BE MENTIONED IS THAT OF IDENTIFICATION OF THE PERSON SEEKING 
ACCESS. IT HAS BEEN WELL DOCUMENTED THAT ALMOST ANYONE CAN SECURE FALSE 
IDENTIFICATION PAPERS WITH FRIGHTENING EASE. A FALSELY IDENTIFIED DRIVER'S 
LICENSE, SOCIAL SECURITY CARD, OR EVEN A PASSPORT IS NOT DIFFICULT TO SECURE. 
HOW TO ASSURE THAT THE PERSON CLAIMING TO BE A FORMER PATIENT IS IN FACT 
THAT PATIENT POSES SERIOUS PROBLEMS TO MEDICAL RECORD PRACTITIONERS IN 
WHOSE CUSTODY AND TRUST MEDICAL RECORDS ARE PLACED. AMRA POSITION STATE- 
MENT RECOMMENDS "CONTINUED DEVELOPMENT OF STATE AND FEDERAL LEGISLATION TO 
IMPOSE PENALITES OF FIVE AND/OR IMPRISONMENT" FOR OBTAINING MEDICAL RECORDS 
UNDER FALSE PRETENSES OR MISUSE OF MEDICAL INFORMATION. 



56-421 O - 80 ~ 23 



348 



RESEARCH 



AMRA BELIEVES THAT MEDICAL RECORDS, SHOULD BE MADE AVAILABLE FOR 
RESEARCH TO INDIVIDUALS WHO HAVE HAD PROJECTS APPROVED BY APPROPRIATE IN- 
STITUTIONAL BOARDS AND AUTHORITIES. DATA COMPILED AS A PART OF RESEARCH 
PROJECTS MAY NOT INCLUDE PATIENT IDENTITY WITHOUT CONSENT OF THE PATIENT. 

THOSE WHO CONDUCT BONAFIDE RESEARCH PROJECTS SHOULD BE BOUND TO 
PRESERVE THE CONFIDENTIALITY OF PERSONALLY IDENTIFIABLE INFORMATION, AND 
MAY DISCLOSE INFORMATION ONLY IN THE FORM OF AGGREGATE DATA. EVIDENCE 
THAT THE DATA COULD BE USED ONLY IN THIS MANNER SHOULD BE REQUIRED BEFORE 
RECORDS ARE RELEASED TO RESEARCH STAFF. HOWEVER, THIS SUBJECT SHOULD BE 
SPECIFICALLY ADDRESSED AND APPROPRIATE PROVISIONS MADE IN ANY LEGISLATION 
ON PRIVACY OF MEDICAL INFORMATION. 



349 



AUTHORIZATIONS 



THE .MAJORITY OF RELEASES OF MEDICAL RECORDS ARE MADE ONLY AFTER THE 
PATIENT HAS SIGNED AN AUTHORIZATION FOR RELEASE OF SUCH INFORMATION. HOWEVER, 
A MAJOR PROBLEM IN THE CONFIDENTIALITY QUESTION IS THE FORMAT AND METHODOLOGY 
OF SUCH AUTHORIZATIONS OR CONSENTS SIGNED BY THE PATIENT. THERE ARE 
THREE TYPES OF CONSENTS WHICH POSE A PROBLEM: THE "BLANKET CONSENT," THE 
"PROSPECTIVE CONSENT," AND THE "PERPETUAL CONSENT." 

FIRST, IN "BLANKET CONSENT," PATIENTS OR GUARDIANS ARE ASKED TO SIGN 
RELEASES WHICH ALLOW FACILITIES TO DISSEMINATE "ANY AND ALL" IDENTIFIABLE 
INFORMATION TO WHOMEVER IS OFFERING A BENEFIT OR SERVICE TO THE PATIENT. THE 
PATIENT IS NOT HIMSELF "INFORMED" AS TO THE FULL EXTENT OF THE RECORD'S 
CONTENT, WHICH SEGMENTS OF IT WILL BE OPEN TO THIRD PARTY ACCESS, OR WHAT 
WILL HAPPEN TO THE INFORMATION ONCE IT IS IN THE THIRD PARTY'S POSSESSION. 
"BLANKET CONSENT" DOES NOT SERVE TO INSTILL A SENSE OF RESPONSIBILITY IN 
THE COLLECTORS, STORERS AND USERS OF PATIENT DATA. 

SECOND, DIFFICULTY ARISES FROM THE COMMON THIRD PARTY PRACTICE OF 
REQUESTING "PROSPECTIVE CONSENT," OR CONSENT OF RELEASE OF INFORMATION PRIOR 
TO TREATMENT. THIS MEANS THAT THE PATIENT IS CONSENTING TO THE DISSEMINATION 
OF THAT WHICH IS NOT YET COLLECTED, A PRACTICE WHICH PRECLUDES ANY INTELLIGENT 
DECISION-MAKING ON THE PART OF THE PATIENT. 

THIRD, MOST INSURANCE COMPANIES REQUEST A FORM OF CONSENT WHICH COULD 
BE CONSTRUED AS "PERPETUAL CONSENT," SINCE THERE IS NO ATTENDANT TIME LIMIT 
SET FOR VALIDITY OF THE CONSENT. WITH OTHER REQUESTORS, HEALTH CARE INSTITUTIONS 
VARY IN THE TIME LIMITS WITHIN WHICH THEY ACCEPT PATIENT CONSENT AS "CURRENT." 



350 



IN SOME CASES HEALTH CARE INSTITUTIONS ARE ADOPTING MORE STRINGENT LIMITS, 
BUT THERE IS NO UNIFORMITY OF POLICY IN THIS AREA. 

THE MOST FREQUENT DISCLOSURE OF MEDICAL RECORD INFORMATION IS TO THIRD 
PARTY PAYORS: BLUE CROSS, BLUE SHIELD, COMMERCIAL INSURANCE CARRIERS, AND 
FEDERAL AND STATE GOVERNMENTS WHETHER DIRECTLY OR THROUGH FISCAL INTER- 
MEDIARIES, FOR REIMBURSEMENT OR CLAIMS PURPOSES. 

THE AMOUNT OF INFORMATION PROVIDED IS USUALLY DETERMINED IN RELATION TO 
THE PURPOSE AND TO THE SCOPE OF AUTHORIZATION. THE DEMANDS OF THIRD PARTY 
PAYORS WERE, IN THE PAST, REASONABLY LIMITED. INCREASINGLY DURING THE PAST 
SEVERAL YEARS, DEMANDS FOR MORE EXTENSIVE DOCUMENTATION IN CONNECTION WITH 
CLAIMS PROCESSING HAVE EXPANDED TO INCLUDE COPIES OF DISCHARGE SUMMARIES OR, 
MORE AND MORE FREQUENTLY ESPECIALLY FOR MEDICARE OR MEDICAID REIMBURSEMENT, 
PHOTOCOPIES OF THE ENTIRE RECORD . THIS PRESENTS A COSTLY AND TIME CONSUMING 
DEMAND AND THE EXTENSIVE DISCLOSURE INVOLVED IS DISTURBING TO MEDICAL RECORD 
PRACTITIONERS IN LIGHT OF THEIR ETHICAL RESONSIBILITIES. 

WE BELIEVE THAT THE PRACTICE OF COPYING ENTIRE MEDICAL RECORDS FOR 
REVIEW OUTSIDE HOSPITAL PREMISES IS A PRACTICE LARGELY FOR THE "CONVENIENCE" 
OF FISCAL INTERMEDIARIES, INSURANCE COMPANIES, PSRO'S, ETC. AMRA HAS 
VOICED ITS OPPOSITION TO THIS PRACTICE TO NO AVAIL. 

■ THE MEDICAL RECORD PRACTITIONER IS EXPECTED BY THE ADMINISTRATION AND 
THE MEDICAL STAFF TO USE DISCRETION IN THE AMOUNT AND KIND OF INFORMATION 
RELEASED AND TO REQUIRE ASSURANCE IN THE FORM OF WRITTEN AUTHORIZATION TO 
DISCLOSE. THIS RESPONSIBILITY PLACES THE MEDICAL RECORD PRACTITIONER IN THE 
ALMOST IMPOSSIBLE POSITION OF TRYING TO DETERMINE, WHICH RESPECT TO THE 
RELEASE OF MEDICAL INFORMATION ABOUT AN INDIVIDUAL, WHETHER THAT INDIVIDUAL 
WAS AWARE OF THE FULL IMPLICATIONS OF THE INFORMATION THAT MIGHT BE DISCLOSED 



351 



OR HOW IT MIGHT BE USED WHEN HE SIGNED THE AUTHORIZATION FORM. THIS 
DILEMMA STEMS FROM THE ABSENCE OF SPECIFICITY IN AUTHORIZATION FORMS. 

MEDICAL RECORD PRACTITIONERS WOULD BE RELIEVED OF THE BURDEN OF TRYING 
TO DECIDE WHAT IS APPROPRIATE TO INCLUDE IN A REPORT DISCLOSING PERSONAL 
HEALTH INFORMATION IF THERE WERE A CAREFULLY DESIGNED, UNIVERSALLY ACCEPTED 
AND MANDATED GUIDELINES FOR AUTHORIZATION OF RELEASE OF MEDICAL INFORMATION 
FORM THAT PERMITS THE INDIVIDUAL TO HAVE FULL KNOWLEDGE ABOUT THE EXTENT 
TO THE DISCLOSURE AND THE USES TO WHICH THE INFORMATION WILL BE PUT SO 
THAT HE CAN GIVE AN INFORMED CONSENT. 

THE AMERICAN MEDICAL RECORD ASSOCIATION'S POSITION STATEMENT INCLUDES 
THE FOLLOWING MODEL POLICY ON AUTHORIZATIONS: 

ALL INFORriATION CONTAINED IN THE HEALTH RECORD IS CONFIDENTIAL AND THE 
RELEASE OF INFORMATION WILL BE CLOSELY CONTROLLED. A PROPERLY COMPLETED 
AND SIGNED AUTHORIZATION IS REQUIRED FOR RELEASE OF ALL HEALTH INFORWTION 
EXCEPT: 

A. AS REQUIRED BY LAW 

B. FOR RELEASE TO ANOTHER HEALTH CARE PROVIDER CURRENTLY INVOLVED IN 
THE CARE OF THE PATIENT 

C. FOR MEDICAL CARE EVALUATION 

D. FOR RESEARCH AND EDUCATION 

IN KEEPING WITH THE TENET OF INFORMED CONSENT, A PROPERLY COMPLETED AND 
SIGNED AUTHORIZATION TO RELEASE PATIENT INFORMATION SHALL INCLUDE AT LEAST 
THE FOLLOWING DATA: 

A. NAME OF INSTITUTION THAT IS TO RELEASE THE INFORMATION 

B. NAME OF INDIVIDUAL OR INSTITUTION THAT IS TO RECEIVE THE INFORMATION 

C. PATIENT'S FULL NAME, ADDRESS AND DATE OF BIRTH 



352 



D. PURPOSE OR NEED FOR INFORMATION 

E. EXTENT OR NATURE OF INFORMATION TO BE RELEASES, INCLUDING 
INCLUSIVE DATES OF TREATMENT - NOTE: AN AUTHORIZATION SPECIFYING 
"ANY AND ALL INFORMATION ..." SHALL NOT BE HONORED 

F. SPECIFIC DATE, EXENT OR CONDITION UPON WHICH CONSENT WILL EXPIRE 
UNLESS REVOKED EARLIER 

G. STATEMENT THAT CONSENT CAN BE REVOKED BUT NOT RETROACTIVE TO THE 
RELEASE OF INFORMATION MADE IN GOOD FAITH 

H. DATE THAT CONSENT IS SIGNED - NOTE: DATE OF SIGNATURE MUST BE 

LATER THAN THE DATES OF INFORMATION TO BE RELEASED 
I. SIGNATURE OF PATIENT OR LEGAL REPRESENTATIVE 

WE BELIEVE THAT LEGISLATION WHICH PROVIDES STRICT PROVISIONS FOR 
AUTHORIZATIONS WILL BE A GREAT ASSET TO LIMITING DISCLOSURE OF INFORMATION, 
ESPECIALLY COPYING AND DISSIMINATING ENTIRE COPIES OF MEDICAL RECORDS. WE 
CAUTION CONGRESS, HOWEVER, NOT TO PLACE THE SOLE PROVISION FOR PROPER 
AUTHORIZATION IN A MEDICAL RECORD PRIVACY ACT. RESPONSIBILITY SHOULD ALSO 
BE PLACED ON THE INSURANCE INDUSTRY THROUGH LEGISLATION ON INSURANCE PRIVACY. 
SUCH RESPONSIBILITY INCLUDES THE MEDICARE/MEDICAID AND OTHER FEDERAL INSURANCE 
PROGRAMS AS WELL AS PRIVATE CARRIERS. 



353 



DISCLOSURE WITHOUT AUTHORIZATION 

RELEASE OF MEDICAL RECORDS WITHOUT A SIGNED AUTHORIZATION IS CON- 
SIDERED A LEGITIMATE PRACTICE UNDER SEVERAL INSTANCES: RELEASE TO HEALTH 
EMPLOYEES AND CONSULTANTS, FOR HEALTH RESEARCH, AUDITS AND EVALUATIONS, 
PUBLIC HEALTH AND SAFETY, LAW ENFORCEMENT, JUDICIAL AND ADMINISTRATIVE PRO- 
CEEDINGS AND PER SUBPOENA, SUMMONS, OR SEARCH WARRANTS. 

IT IS DOUBTFUL THAT ANY USEFUL PURPOSE WOULD BE SERVED BY MANDATING 
THE ROUTINE NOTIFICATION TO THE SUBJECT OF ALL RELEASE OF INFORMATION IN 
ANY AND ALL CIRCUMSTANCES, THE COST OF DOING SO, INCLUDING THE COST OF 
PERSONNEL TIME, WOULD BE SUBSTANTIAL, AND THE WORK LOAD IN A BUSY MEDICAL 
RECORD DEPARTMENT IS SUCH AS TO MAKE DIFFICULT, IF NOT IMPOSSIBLE, THE 
PREPARATION AND MAILING OF SUCH NOTICES IN A TIMELY MANNER. ANY REQUIREMENT 
FOR PROVISION OF NOTICE TO THE SUBJECT MIGHT BETTER BE PLACED ON THE AGENCY, 
PERSON, OR COURT REQUESTING OR ORDERING THE INFORMATION IN THOSE CIRCUM- 
STANCES IN WHICH THE SUBJECT DOES NOT SIGN A SPECIFIC CONSENT TO RELEASE 
FROM. THE HEALTH FACILITY SHOULD INFORM THE PATIENT OF REGARDING CIRCUM- 
STANCES IN WHICH HIS MEDICAL RECORDS WILL BE RELEASED WITHOUT HIS AUTHORI- 
ZATION, HOWEVER. 

ALSO, ANY LEGISLATION SHOULD STATE EXPLICIT CIRCUMSTANCES UNDER 
WHICH MEDICAL RECORDS CAN BE OBTAINED WITHOUT AUTHORIZATION ANY SHOULD PRO- 
VIDE SAFEGUARDS TO PREVENT DIRECT OR INDIRECT IDENTIFICATION OF PATIENTS 
OR FURTHER DISCLOSURE FROM THOSE RECEIVING RECORDS. 



354 



COMPUTERIZED DATA 

THE HEALTH INDUSTRY IS ACUTELY AWARE OF THE INSIDIOUS EROSION OF 
CONFIDENTIALITY BROUGHT ON BY GROWING DEMANDS FOR MEDICAL INFORMATION. 
INFORMATION TRANSFER IS STAGGERING AND EXPENSIVE. TO MEET THE DEMANDS AND 
NEEDS FOR INFORMATION, HEALTH CARE FACILITIES AND RECIPIENTS OF INFORMATION 
HAVE TURNED TO COMPUTERIZED SYSTEMS. 

INFINITE -STORAGE CAPACITY AND LINKAGE ABILITY BETWEEN COMPUTERIZED 
TECHNOLOGIES HAS DEALT THE GREATEST BLOW TO CONFIDENTIALITY. MASSIVE 
NATIONWIDE DATA SYSTEMS ARE OPERATED BY BLUE CROSS/BLUE SHIELD, MEDICARE, 
DHEW, PSRO'S, PRIVATE INSURANCE CARRIERS AND INSURANCE SERVICE FIRMS SUCH 
AS THE MEDICAL INFORMATION BUREAU AND EQUIFAX. THESE SYSTEMS NOT ONLY HAVE 
THE CAPACITY TO LINK DATA BUT ARE ACTIVE IN THIS ENDEAVOR. PERHAPS THE 
MOST FRIGHTENING ASPECT OF COMPUTERIZATION IN HEALTH TODAY IS ACTIVITY 
SUPPORTED BY CONGRESS THROUGH PASSAGE OF PUBLIC LAW 95-142 MEDICARE/MEDICAID 
ANTI-FRAUD AND ABUSE AMENDMENTS OF 1977, SECTION 19, AND UNDER THE JURISDIC- 
TION OF THE DEPARTMENT OF HEALTH, EDUCATION, AND WELFARE'S HEALTH CARE 
FINANCING ADMINISTRATION. DHEW WILL SOON ISSUE PROPOSED REGULATIONS WHICH 
CALL FOR THE COLLECTION OF A UNIFORM HOSPITAL DISCHARGE DATA SET (UHDDS) 
WHICH INVOLVES PATIENT AND PROVIDER IDENTITIES, DIAGNOSES, ETC. THE UHDDS 
WILL BE COLLECTED AND PROCESSED BY REGIONAL PROCESSORS, WHICH MAY INCLUDE 
FISCAL INTERMEDIARIES, MEDICAL RECORD DISCHARGE ABSTRACT PROCESSES, PSRO'S, 
AND INSURANCE COMPANIES. IDENTIFIABLE DATA WILL BE LINKED TO BILLING DATA 
AND STORED IN A NATIONAL DATA BANK IN THE DHEW. DATA WILL BE DISTRIBUTED TO 
PSRO'S, HSA'S, AND OTHER FEDERAL DEPARTMENTS. THE NATIONAL HEALTH COM- 
PUTER BANK WHICH WE WERE TOLD" WOULD NEVER BE CREATED IS HERE. THERE IS NO 
REASON TO BELIEVE THAT AT SOME FUTURE DATE THIS HEALTH DATA WILL NOT BE 



355 i 

LINKED TO FBI, CIA, IRS, CREDIT, INSURANCE AND OTHER COMPUTERS. AMRA HAS 
VOICED STRONG OPPOSITION TO DHEW PLANS FOR DATA COLLECTION AND WE AWAIT 
PROPOSED REGULATIONS. 

ANY NATIONAL HEALTH INSURANCE (NHI) PROGRAM IS LIKELY TO EXPAND 
REPORTING REQUIREMENTS AND CENTRALIZE THE INFORMATION COLLECTED IN DATA 
BANKS. THE PROTECTION OF THESE CENTRALIZED RECORDS AGAINST IMPROPER DIS- 
CLOSURE AND USE BECOMES THE RESPONSIBILITY OF THOSE WHO MAINTAIN THE DATA 
BANKS. UNFORTUNATELY, IT IS KNOWN THAT CODES CAN BE BROKEN AMD THAT THERE 
APPEARS TO BE NO KNOWN ABSOLUTE SAFEGUARD AGAINST UNLAWFUL ACCESS TO COMPU- 
TER-STORED INFORMATION. 

■ LEGISLATION CREATED THE AUTHORITY FOR CURRENT COMPUTER ACTIVITY. 
ANY LEGISLATION ON DATA SECURITY MUST FIRST PUT LIMITS ON DATA COLLECTED 
AND PLACE STRINGENT RESTRICTIONS ON RELEASE AND LINKAGE. 



356 



SUMMARY 

THE MEDICAL RECORD PRACTITIONERS, HEALTH PROVIDERS AND PATIENTS ARE 
IN A SERIOUS DILEMMA OVER CONFIDENTIALITY. THE DILErM\ OF THE MEDICAL RECORD 
PROFESSION CENTERS ON HOW TO FULFILL THE OBLIGATIONS TO PROVIDE NEEDED 
INFORMATION TO SERVE THE PATIENT, PROVIDER, AND THE COMMUNITY WHILE PRO- 
TECTING THE PATIENT. THE DILEMMA FOR THE HEALTH PROVIDER IS CONFIDENTIALITY 
VS. PAYMENT FOR SERVICES ON A TIMELY BASIS TO ASSURE CASH FLOW. THE 
DILEfW FOR THE PATIENT IS CONFIDENTIALITY VS. INSURANCE, EMPLOYMENT, CREDIT 
AND OTHER SERVICES. IN REALITY, THE QUESTION COMES DOWN TO CONFIDENTIALITY 
VS. MONEY! 

IN SUMMARY, THE AMERICAN MEDICAL RECORD ASSOCIATION STRONGLY SUGGESTS 
VOLUNTARY AND LEGISLATIVE EFFORTS: 

* TO PROVIDE PATIENT ACCESS TO MEDICAL RECORDS WITH PROPER RESTRICTIONS 

* TO ASSURE THE PATIENT FULL KNOWLEDGE OF AND CONTROL OVER DISSIMINATION 
OF HIS PRIVATE INFORMATION THROUGH STRICT AUTHORIZATION FOR RELEASE OF 
INFORMATION 

* TO CONTROL RE-DISCLOSURE BY SECONDARY RECIPIENTS AND USERS OF MEDICAL 
INFORMATION 

* TO CONTROL LINKAGE OF COMPUTERIZED HEALTH INFORMATION SYSTEMS. 

* IN CONCLUSION, I QUOTE FROM COMPUTERS, HEALTH RECORDS. AND CITIZENS RIGHTS 
A STUDY CONDUCTED UNDER THE INSTITUTE FOR COMPUTER SCIENCES OF THE NATIONAL 
BUREAU OF STANDARDS, BY ALAN WESTIN, "AS AMERICAN SOCIETY REDEFINES AND 
REORGANIZES ITS HEALTH-CARE SYSTEM IN THE COMING DECADE, IT WILL HAVE TO 

MAKE INCREASED USE OF COMPUTER TECHNOLOGY TO MANAGE THE RIVERS OF DATA THAT 
WILL BE GENERATED ... IF THE QUESTION IS NOT WHETHER BUT HOW SUCH TECHNOLOGY 
WILL BE USED IN HEALTH CARE, AMERICAN SOCIETY HAS ONE NONNEGOTIABLE CONDITION 
FOR THIS PROCESS: BASIC CITIZEN RIGHTS CANNOT BE MADE A CASUALTY OF 
TECHNOLOGY- ASSISTED HEALTH SYSTEMS. TO DO SO WOULD BE TO BETRAY THE 
TRADITION OF HIPPOCRATES, AND ULTIMATELY TO DEHUMANIZE HEALTH CARE ITSELF," 



357 

Mr. Drinan. Dr. Jerome Beigler is the Chairman of the Ameri- 
can Psychiatric Association Committee on ConfidentiaUty. 
We welcome you here, Doctor. You may proceed as you see fit. 

STATEMENT OF DR. JEROME S. BEIGLER, CHAIRPERSON, COM- 
MITTEE ON CONFIDENTIALITY, AMERICAN PSYCHIATRIC 
ASSOCIATION 

Dr. Beigler. Thank you. 

Mr. Chairman, the American Psychiatric Association, a medical 
specialty society representing over 24,000 psychiatrists nationwide, 
appreciates the opportunity to testify before your subcommittee on 
the need for legislative proposals to protect the confidentiality of 
medical records. 

I am Dr. Jerome S. Beigler, chairperson of the Committee on 
Confidentiality of the American Psychiatric Association, and a 
member of the executive committee of the National Commission on 
the Confidentiality of Health Records, a privately funded consor- 
tium of 24 national provider and consumer organizations. I am also 
clinical professor of psychiatry at the University of Chicago 
Pritzker School of Medicine and president of the Illinois Psychiat- 
ric Society. 

It is indeed an honor and privilege to appear before this subcom- 
mittee to discuss the considerable problems involved in maintain- 
ing the confidentiality of medical and psychiatric records in our 
information-hungry society. 

For a society so complex as ours to function optimally, an ambi- 
ence must be provided for the maximum expression of the talent of 
our highly-endowed citizenry. As evidenced by the outstanding 
leadership over the past 200 years in such fields as politics, eco- 
nomics, literature, and science, our democracy, as designed by our 
Founding Fathers, works better than any other system of govern- 
ment yet devised by man. 

To preserve that democracy, the Bill of Rights was added to the 
Constitution in order to protect American citizens from their own 
Government. The power of our Constitution to protect our political 
system has been severely tested during the past two decades, as in 
the Joe McCarthy problem and the Nixon episode, in which our 
roots were severely tested, and has proven its worth reassuringly. 
But the healthy nature of our political process has inherent in it 
the development of repeated challenges to the roots of our democ- 
racy. 

One of these important roots is the ability to provide real privacy 
even in an ever-increasingly information-hungry society. It is in 
the context of a challenge to the democratic process itself that we 
see the crucial importance of protecting the confidentiality of medi- 
cal and particularly psychiatric records. 

To avail oneself of psychiatric help, it is necessary that the most 
intimate and private thoughts be disclosed to the physician. Any 
interference with the maintenance of confidentiality of such com- 
munications impairs the ability of a psychiatrist to help his or her 
patient. Because the material disclosed to a psychiatrist includes 
information relevant to a patient's relationships to the whole out- 
side world, the psychiatrist becomes the repository of information 
valuable to many third parties, such as insurance carriers, legal 



358 

adversaries, law enforcement agencies, and employers. To the 
extent that such information is disclosed without the patient's 
consent, the reliability of the doctor-patient relationship is eroded 
and the ability of a physician to help his or her patient is impaired. 

It is not commonly understood that in most States there are no 
laws that effectively protect the confidential information revealed 
to a psychiatrist. In the past there were few cases in which 
breaches of confidentiality became significant problems to the pa- 
tient. As, however, the requirements for more information by in- 
surance carriers, litigants, and Government agencies increased, 
many complaints were received of intolerable incursions into the 
privacy of the doctor-patient and particularly the psychiatrist-pa- 
tient relationship. 

It is necessary to draw a new balance between on the one hand 
society's need to provide an ambience in which stressed patients 
may be restored or helped to a state of maximum productivity and 
on the other hand to provide access to information required by a 
complex society troubled by economic problems, fiduciary immoral- 
ity, and crime. 

I have divided the main problem aeas into three specific zones. 
This has to do with insurance, litigation, and law enforcement. I 
will try to discuss these in order. 

You have already heard in previous testimony about the insur- 
ance problems as far as confidentiality is concerned. A common 
type of problem stemming from breaches of confidentiality regard- 
ing medical insurance records occurs when claims for reimburse- 
ment are processed through the employers' personnel offices. Sev- 
eral examples are given in the American Psychiatric Association's 
"Task Force Report 9, June, 1975, Confidentiality and Third Par- 
ties," pages 55 to 59, attachment No. 1. I believe there are close to 
40 examples of so-called horror stories of breaches of confidential- 
ity, either deliberate or inadvertent, because of the processing of 
insurance claims. 

One example, a hospitalized schizophrenic patient was dis- 
charged without being told of the diagnosis because of her fragile 
state. On return to work she found that her fellow employees knew 
about the details of her hospitalization. The insurance company 
had sent a report to the employer. Obviously there had been leaks 
from the personnel office. The patient became paranoid, resented 
learning about herself from employees, and terminated treatment 
to her detriment. 

A second patient first learned of her diagnosis from a notice the 
insurance company sent reporting her bill had been paid. A third 
patient was assured that no sensitive information from the insur- 
ance company would reach the employer. The entire treatment was 
damaged and the patient became worse when it was learned the 
employer knew of the treatment and other factors. 

Due to problems of the type outlined above, and because psychi- 
atric treatment is still regrettably considered a stigma in our soci- 
ety, many employes do not use their paid for insurance benefits 
lest their careers be imperiled by being labeled as psychiatric pa- 
tients. Federal employees, armed services officers, corporate execu- 
tives, politicians, and teachers often would realistically jeopardize 



359 

their careers should their psychiatric treatment be recorded in 
their personnel file. 

There are communities in which teachers are not hired, rehired, 
tenured, or promoted should it be learned that they are being 
treated by a psychiatrist. The paradox is that these conscientious 
teachers who recognize a need for help are discriminated against 
whereas other teachers who are less insightful have their employ- 
ment continued and take out their illness on the children. 

A specific example, a young man in my own practice was an aide 
to a prominent Federal employee. He deliberately did not avail 
himself of his Federal employee's health insurance benefits to un- 
derwrite his psychiatric treatment lest some unauthorized person 
learn of his treatment as the result of the claims processing and 
then use that informaton with the patient's superior as a political 
gambit. 

Not only would such a disclosure threaten his job security, but 
he was of sufficient talent and stature so that he had the potential 
within 10 to 15 years of himself becoming a national figure and 
therefore could not hazard such experience for himself. 

He was able to pay for his treatment on his own, solved the 
immediate psychiatric problem, and was free to pursue his promis- 
ing career. He was able to solve the dilemma of whether or not to 
use his insurance benefits easily, but others in need of such treat- 
ment are less fortunate, and are left with psychiatric problems, 
chronic distress, and impaired productivity, all to the detriment of 
society. 

I have illustrated above two types of problems resulting from the 
insurance industry not being able to maintain the confidentiality of 
claims processing: (1) Actual injuries due to unauthorized disclo- 
sures and (2) actual and threatened perils to careers should the fact 
of psychiatric treatment become known. 

The insurance industry often claims it cannot monitor cost-effec- 
tiveness of its benefits unless there is complete access to the confi- 
dential information transmitted in the psychiatrist-patient rela- 
tionship. Over the years it has been demonstrated repeatedly that 
effective monitoring of psychiatric care can be maintained of the 
Federal employee plan Blue Cross-Blue Shield, Washington, pa- 
tients via the utilization of a claims form requiring minimal infor- 
mation. It has been demonstrated that it is possible to maintain 
insurance-benefit cost-control and yet observe confidentiality. Effec- 
tive methods of maintaining confidentiality are being further 
tested via peer review pilot studies. 

The problem of unauthorized disclosures of confidential informa- 
tion by employer personnel offices can be solved simply by routing 
insurance benefit claims directly to the insurance carrier's medical 
director's office, thus bypassing the personnel office. This is already 
being done successfully in several large corporatons. 

Employers receive only utilization profiles without identifying 
information. Personnel and medical records clerks are educated as 
to the importance of the sensitive material they process and to 
their obligation to maintain confidentiality. The American Psychi- 
atric Association has devised, as you know, a model State statute 
on confidentiality — see attachment 2 — mandating such protections 
of privacy. The feasibility of such a model law has already been 



360 

demonstrated by having a very similar law already enacted in 
Illinois, including penalties for breach of confidentiality — see at- 
tachment No. 3. 

A second major area in which confidentiality problems arise is in 
matters of litigation, particularly regarding personal injury suits, 
divorce, and custody cases, and contested insurance claims cases. 
Because psychiatric treatment depends on the disclosure of sensi- 
tive information, a psychiatric patient is particularly vulnerable to 
the adversarial discovery process should he become involved in 
litigation. 

A specific example is from my own practice. As a matter of fact, 
this is how I became initiated into this problem. A former patient 
was hit by a recklessly driven car while she was parked in a 
parking lot of a supermarket. She sustained a spinal injury and 
disability. Her lawyer sued for damaged, including "pain and suf- 
fering." 

At that time Illinois' psychiatrist-patient privilege law provided a 
"patient-litigant exception." Defendant's lawyer correctly and re- 
sourcefully claimed that "pain and suffering" constituted having 
brought "mental condition into issue," thereby waiving the plain- 
tiffs privilege, and my records and testimony were subpenaed. 

The patient had disclosed to me during treatment many intima- 
cies that would be profoundly against her interest should they be 
disclosed during discovery. Yet the therapeutic disclosures were 
prerequisite to the considerable success of her treatment, which 
enabled her to become a contributing, self-supporting, and function- 
al member of society again. The judge refused to limit my testimo- 
ny only to the issues relevant to the suit. We could resolve the 
dilemma only by withdrawing the claim for pain and suffering. 

It thus became clear that a patient who enters psychiatric treat- 
ment automatically jeopardizes future rights to legal redress other- 
wise available to citizens who had not undertaken such treatment. 
Subsequently, two Illinois Appellate Court decisions ruled that 
"pain and suffering" did not constitute "mental condition" — see 
attachment No. 4 — and this provision is included in the cited new 
Illinois confidentiality law and the cited APA model State law. It 
would be wise if — and we so recommend — a similar provision were 
included in Federal legislation. 

Another confidentiality and privilege problem arises in divorce 
and custody cases in States which do not have a no fault divorce 
law. Should a divorce suit be brought on the ground of "mental 
cruelty," "mental condition" is considered to have been brought 
into issue, thereby waiving the psychiatrist-patient privilege and 
exposing a patient to the hazards of the psychiatrist's testimony. 

It becomes apparent that such a privilege law interpretation 
tends to foster divorce because a sophisticated couple with a mari- 
tal problem would not seek out counseling to resolve their problem, 
lest their communications be disclosed during future divorce or 
custody litigation. 

The Illinois legislature wisely recognized the nature of this prob- 
lem and provided the divorce and custody exception to the patient- 
litigant exception — see attachment No. 4 — in the cited 1979 Illinois 
confidentiality law and the cited APA model law. A similar proviso 
is recommended for inclusion in a Federal confidentiality law. 



361 

A third privilege law problem as far as litigation is concerned 
arises when "mental condition" actually is brought into legal issue, 
thereby waiving privilege for "relevant" testimony. For example, 
traumatic neurosis or the psychiatric condition itself is made part 
of the litigation. The question arises in defining "relevant." The 
issue has been argued in several famous California cases, including 
"In re Lifschutz" and Caesar v. Mountanos. 

In the latter case Judge Shirley Hufstedler in a dissenting opin- 
ion advocated a court-appointed examining psychiatrist testify 
after examining the patient, thereby relieving the treatment psy- 
chiatrist from jeopardizing his therapeutic relationship with the 
patient. The therapist is called for in camera testimony only if the 
court-appointed psychiatrist cannot make an adequate assessment. 

Testimony from such a court-appointed psychiatrist is the prac- 
tice in Michigan, and has been incorporated in both previously 
referred to Illinois confidentiality law and the APA model law. In 
addition, unique to the Illinois law, it protects the patient from 
inadvertent or ill-advised waiver of privilege by providing an over- 
riding, limited privilege to the psychiatrist when he exercises it "in 
the interest of and on behalf of the patient. 

Contested insurance claims also engender medical record confi- 
dentiality problems. As you know by now, a multimillion-dollar-a- 
year industry developed as the result of insurance companies pro- 
viding a market for unauthorized disclosures of confidential medi- 
cal information. 

A Denver, Colo., State's attorney demonstrated that the Factual 
Services Bureau was able to furnish, (1) unauthorized medical in- 
formation to insurance companies from any hospital or even, (2) a 
doctor's private office original files. This was done by deceptive 
impersonation of medical personnel and other resourceful and 
criminal methods. 

Insurance companies evidently wanted complete access to such 
sensitive records to plan their reserves, and also to use sensitive 
information as bargaining leverage. For example, in one contested 
back injury claim the Factual Service Bureau in their procedures 
discovered a history of venereal disease in the hospital chart. The 
patient settled his claim at a lower figure rather than have this 
information disclosed in court. The new Illinois confidentiality law 
and the APA model law provide penalties for such fraudulent 
practice. 

Now I come to the third major area of problems. I consider this 
the most important element in the testimony I am presenting. 
That has to do with the increasing insistence by various legislative 
bodies that law enforcement agencies have access to physicians' 
and psychiatrists' records. 

Access to medical and psychiatric records by law enforcement 
agencies has increased dramatically in the past 2 years. These 
unprecedented threats put into perspective how essential medical 
privacy and confidentiality are to our democratic process and em- 
phasize how important it is to protect confidentiality and privilege 
in the areas of insurance and litigation as discussed above. If the 
doctor-patient relationship is eroded in one area, it soon follows 
that other areas also will soon be affected. Privacy as a constitu- 
tional right must be protected on all fronts. 



362 

There has been an increasing trend to use physicians, and par- 
ticularly psychiatrists, as agents of social control. Laws have been 
enacted mandating the use of psychiatric records in the assessment 
of driver's license applicants, drug abusers, gun permit applicants, 
and child abusers. We are faced with two social rights. It would be 
convenient to use confidential information for police functions, but 
to do so vitiates the potential usefulness to society of psychiatric 
treatment. 

The most convincing case for breach of psychiatric confidential- 
ity can be made for the reporting of child abuse, but experience is 
proving that reporting of child abusers has, because of limited 
social resources, not been effective. Society will have to determine 
whether to continue its insistence on such reporting. 

The direction of Congress, based upon the action taken with 
respect to the Domestic Violence Prevention and Services Act, S. 
2759, in the 95th Congress, would appear to be toward the need for 
treatment stimulated by protection of medical record confidential- 
ity as done in Federal alcohol and drug abuse treatment programs 
as the appropriate priority. I agree. 

The treatment of alcohol drug abusers provides another instance 
in which the need for effective therapy collides with the need for 
social control. Federal rules and regulations for alcohol and drug 
abuse programs— Public Law 92-255 and Public Law 93-282— 
wisely protect the identities of and clinical material of drug abuse 
clinic patients. Otherwise the patients realistically would not 
attend the clinics and society would lose even its slim chance to 
rehabilitate these unfortunate patients. 

Despite regulations to the contrary, local police and State offi- 
cials have demanded access to such clinic records. One New York 
psychiatrist went to jail to prevent access to his clinic's records. 
The police wanted pictures of his patients. 

In another New York case a crisis intervention center's funds 
were suddenly withdrawn when the State auditor was refused 
access to identifiable records without patient consent. 

Dr. Nyswander, who initiated the methadone treatment pro- 
grams, emphasizes in one of her articles the damage done to reha- 
bilitation programs by "politically inspired — police — control." 

Another example, which illustrates the increasing trend in this 
direction, of using the patient-psychiatrist relationship as a mecha- 
nism of social control involves the well-known California 1976 Tar- 
asoff decision, imposing on psychiatrists a "duty to warn" pre- 
sumed intended victims of their patients' threatened aggression. 
This has resulted in many counterproductive complications to the 
ability of psychiatrists to help their patients. 

Some patients who consider themselves marginally dangerous 
avoid initiating treatment that could help them, lest they be be- 
trayed by their psychiatrist. Some patients have terminated treat- 
ment prematurely, leaving themselves and others unnecessarily 
vulnerable. 

The Tarasoff decision is another example in which well-inten- 
tioned jurisprudence results in the impairment of access of medical 
treatment by our citizens. An unencumbered psychiatrist-patient 
relationship is potentially the most effective method to defuse a 
disequilibrated patient. 



363 

Now we come to two instances which I consider major examples 
of what I have in mind. A major erosion of our democratic process 
resulted from the well-known 1978 U.S. Supreme Court decision in 
the Zurcher v. Stanford Daily News case. The Court upheld the 
validity of a warrant being issued to search a newspaper's offices 
for evidence on a crime involving a third party. The impairment of 
the first amendment right to freedom of the press is readily appar- 
ent and corrective legislation is in process over the country, locally 
and federally. Unfortunately, less readily apparent is the vulner- 
ability of other premises, such as the offices of physicians, lawyers, 
legislators, or even private homes, to such warrants. 

At the hearings before Senator Birch Bayh's Subcommittee on 
the Constitution in September 1978 it became apparent that if the 
Zurcher decision had been available at the time. President Nixon's 
"plumbers" could simply have obtained a warrant to search Dr. 
Fielding's office for Ellsberg's records rather than having to bur- 
glarize the premises. 

The horror of Zurcher to the democratic process is further illus- 
trated by another Palo Alto, Calif, case in which the same sheriff 
was issued a warrant to search the office and home of a Stanford 
psychiatrist for evidence of a crime that may have been committed 
by a patient of hers. No evidence was found. The chilling effect on 
psychiatrists and patients of such searches is obvious. Even more 
disconcerting, however, is the fact that the psychiatrist's husband 
is a famous scientist. His records, too, were rendered accessible by 
the warrant. I think we can contemplate the scenario about the 
possibilities for espionage and threats to the national security if 
such warrants are that readily available. 

The drama of Zurcher is further compounded by the passage in 
1978 of a law, No. 105, in Hawaii authorizing search warrants for 
"probable cause" defined as "public interest." Thus, should an 
official swear that a given "provider" treats medicare or medicaid 
patients and that it is in the public interest to inspect the records 
involved, a warrant can be issued. 

The office of a Hawaiian psychologist has already been searched 
and not only were the records of his medicare and medicaid pa- 
tients confiscated, but also those of his private patients. Due proc- 
ess has been unconscionably eroded. 

The extrapolation of this trend could result in a situation extant 
in Uruguay in which a psychiatrist is imprisoned for collusion 
should he not report the political activities revealed to him by a 
patient. The abuses of psychiatry in Russia also come to mind. 

It is from the background of events illustrated above that the 
American Psychiatric Association on behalf of its millions of actual 
and potential citizen-patients objects strongly to the provisos re- 
garding unreasonable access to medical records by law enforcement 
agencies incorporated into several medical record confidentiality 
acts being introduced in the 96th Congress. We see these provisos 
as further examples of a general trend that will eventuate in 
citizens being unable to avail themselves of psychiatric help and, 
moreover, a trend that will result in major erosions to our whole 
democratic system of government. 

We recognize the intent of such confidentiality legislation to 
protect our citizens, but respectfully point out the profound haz- 



56-421 O - 80 — 24 



364 

ards to patients and to democracy provided by allowing access to 
medical records by law enforcement agencies without due process. 
Similarly, we object to the elimination of due process by provisos 
that mandate compliance to a subpena. 

We recommend that the cited attached APA model law on confi- 
dentiality of health and social service records be studied for its 
extensive protection of privacy and confidentiality. The feasibility 
of such legislation is illustrated by the fact that a similar statute 
has already been enacted in Illinois, effective January 1979, and 
has been introduced in New York. 

I ask that all the cited attachments be made part of the hearing 
record and inserted at the conclusion of my testimony. 

Mr. Drinan. Without objection, so ordered. 

[The material follows:] 



365 



Am J Psychiatry 136:1, January 1979 



OFFICIAL ACTIONS 



Model Law on Confidentiality of Health and Social Service Records 



This document was approved by the Board of Trustees at Us 
September 1977 meeting and by the Assembly Executive 
Committee at its February 1978 meeting. It was prepared by 
the Task Force on Confidentiality of Children's and 
Adolescents' Clinical Records' and the Committee on 
Confidentiality.^ 



1. Scope: 

All confidential information is subject to the provisions of 
this Act. Except as hereinafter provided, or otherwise spe- 
cifically required by federal, state or local law, no person 
shall, without the authorization of the patient/client or his/ 
her authorized representative: 

(a) Disclose or transmit any confidential information to- 
gether with a patientyclient identifier to any person, or 

(b) Disclose or transmit a patient/client identifier to any 
person, or 

(c) Disclose or transmit confidential information if the 
person disclosing or transmitting it has reason to be- 
lieve that the recipient may have a patientyclient iden- 
tifier for such information. 

2. Definitions As Used in This Act: 

(a) "Confidential information" means: 

(i) The fact that a person is or has been a patient/ 
client; 

(ii) Information transmitted in confidence between 
the patient/client and service provider in the 
course of service provision; 

(iii) Information relating to diagnosis, facts necessary 
to the provision of services, or treatment, trans- 
mitted in confidence between members of the pa- 
tient/client's family and the service provider; 

(iv) Information relating to diagnosis, facts necessary 
to the provision of service, or treatment, trans- 
mitted between any of the persons specified in (a) 



'The Task Force on Confidentiality of Children's and Adolescents' 
Clinical Records (1976-1977) included Frank Rafferty, M.D., chair- 
person, John Looney, M.D., Herbert Sacks, M.D., and Lenore 
Petty, M.D., Falk Fellow. Of Counsel: Sandra Nye, J.D., M.S.W. 

'The Committee on Confidentiality (1975-1977) included Jerome 
Beigler, M.D., chairperson, Ben Bursten, M.D., Maurice Gross- 
man, M.D., Alan McLean. M.D., Don Mosher, M.D., Herbert 
Sacks, M.D., Hugo Van Dooren. M.D.. and Robert Friedman. 
M.D., Falk Fellow Of Counsel: Sandra Nye. J.D., M.S.W. 



(b) 



(0 



(d) 



(ii) and (iii) above, and persons who participate in 
the accomplishment of the objectives of diagno- 
sis, fact-finding, or service under the supervision 
of, or in cooperation with, the service provider; 
(v) Any diagnosis or opinions formed by the service 
provider regarding the patient/client's physical, 
mental or emotional condition; 
(vi) Any advice, instructions or prescriptions issued 
by the service provider in the course of diagnosis, 
treatment, or provision of other service; 
(vii) Any summary, resume or characterization of the 
substance, or any part of the information de- 
scribed in sub-sections (f), (i) through (v) of this 
section 2; and 
(viii) Any record, recording, or notation of information 
described in subsection (f), (i) through (vi) of this 
section 2, in whatever form and by whatever 
means recorded or noted. 
(ix) Personal information governed by the School Stu- 
dent Records Act is hereby excluded from the ap- 
plication of this statute. 
"Patient/client" means a person who consults, is ex- 
amined, interviewed, treated, or is otherwise served 
to some extent by a service provider, or a clinical re- 
searcher, as hereinafter defined, with regard to a medi- 
cal, mental, or emotional condition or social depriva- 
tion or dysfunction. 
"Patient/client identifier" means: 
(i) The patient/client's name or other descriptive 
data from which a person well acquainted with the 
client might, with reasonable certainty, recognize 
such patient/client as the described person, or 
(ii) A code, number, or other means to be used to 
match the patient/client with certain confidential 
information regarding him/her. 
"Authorized representative" means: 
(i) A person empowered by the patient/client to as- 
sert or to waive the confidentiality, or to disclose 
or consent to the disclosure of confidential infor- 
mation, as established by this Act. Such person 
shall not, except by explicit authorization, be em- 
powered to waive confidentiality or to disclose or 
consent to the disclosure of, confidential informa- 
tion; 
(ii) If the patient/client is incompetent to assert or 
waive his rights hereunder, or is in an apparently 
life threatening or emergency situation, a guardian 
or conservator, except that pending appointment 
of such guardian or conservator, the nearest avail- 



138 



366 



Am J Psychiatry 136:1, January 1979 



OFFICIAL ACTIONS 



able relative of such patient/client may maintain 
or waive the confidentiality; 

(iii) If the patientydient is deceased, his personal rep- 
resentative or next of kin or 

(iv) If the patient/client is less than twelve (12) years 
of age, his parent or other custodian or guardian. 

(e) "Diagnosis, fact-finding, or provision of service" in- 
cludes observations made for purposes of same and all 
efforts to prevent, ameliorate, or otherwise overcome 
the effects of medical, mental or emotional disorders 
or social deprivation or dysfunction. 

(f) "In confidence" means, private disclosures made or 
intended to be made, so far as the discloser is aware, 
to no other persons except 

(i) The intended recipient; 

(ii) Those who are present to further the interest of 
the patient/client in consultation, examination or 
interview, diagnosis, treatment, or other service 
provided; 

(iii) Those to whom disclosure is reasonably neces- 
sary for the transmission of the information or the 
accomplishment of diagnosis or treatment, includ- 
ing members of a therapy group of which the pa- 
tient/client is a participant, and members of the 
client's family; supervisors or other persons par- 
ticipating in consultation, examination or inter- 
view, diagnosis, or treatment, or other service 
provided under the direction of the provider; 
third-party payers; and 

(iv) Persons reasonably believed to be engaged in 
good faith in training programs relevant to the ac- 
tivities of the service provided. 

(g) "Person" means any natural person, corporation, as- 
sociation, partnership, and any state, local or federal 
government, or any agency or other part thereof, in- 
cluding a court. 

(h) "Service provider" means any person authorized by 
statute to provide medical, psychological, psycho- 
therapeutic, psychoanalytic, child welfare and/or oth- 
er social services; any person reasonably necessary 
for evaluation, diagnosis, consultation, treatment, or 
care under the supervision of the provider; and, any 
person reasonably believed by the client to be so au- 
thorized or engaged. 

3. Authorized Disclosures: 

(a) Consent may be given by a patient/client who is twelve 
(12) years of age or over or by his authorized represen- 
tative, for the transmission or disclosure of con- 
fidential information. Such consent shall be effective 
only if it is in writing and signed, and also specifies the 
nature and content of the information to be disclosed, 
to what person such information may be transmitted 
or disclosed, and to what use the transmitted or dis- 
closed information may be put. Such specifications 
shall constitute the limits of the authorization. Every 
person requesting such authorization shall inform the 
patient/client or authorized representative that refusal 
to give such consent will in no way jeopardize his right 
to obtain present or future service, except where and 
to the extent disclosure is necessary for service to said 
patient/client, or for the substantiation of a claim for 
payment from a person other than the patient/client. 
The patient/client, or his authorized representative, 
may withdraw any such consent at any time in writing 
transmitted to and received by the person authorized 



to receive such confidential information. Upon receipt 
of such withdrawal, the person previously authorized 
to receive said information shall exercise reasonable 
care in promptly notifying all persons who had pre- 
viously transmitted information on the basis of said 
consent, or who might reasonably be expected to do 
so in the future, that the prior consent has been with- 
drawn. If consent had been obtained by a person other 
than the person thereby authorized to receive said in- 
formation, the person who obtained said consent 
shall, upon request, promptly, and in the exercise of 
reasonable care, assist the patient/client in ascertain- 
ing the correct name and address to which the with- 
drawal should be sent. Withdrawal of such consent 
shall have no effect upon disclosures made prior there- 
to, 
(b) If the patient/client is under twelve ( 12) years of age or 
incompetent, consent may be given for the transmis- 
sion or disclosure of confidential information by the 
patient/client's authorized representative. 

4. Disclosures Without Authorization: 

Consent from the patient/client shall not be required for 
the disclosure or transmission of confidential information in 
the following situations, as specifically limited: 

(a) Within the service-providing facility: Confidential in- 
formation may be disclosed to other individuals em- 
ployed by the service provider, and to officially desig- 
nated auditors and surveyors for accreditation, when 
and to the extent to which the performance of their 
duties in employment, audit or accreditation requires 
that they have access to such information. For pur- 
poses of this subsection (a), (i) persons engaged in 
good faith in training programs at a service providing 
facility and their clinical supervisors are to be consid- 
ered as being employed by the service provider and 
may have access to such records and information to 
the extent reasonably required in their training and 
duties, but, (ii) individuals employed by the service 
provider or audit or who are involved in financial au- 
dit, preparation of bills or who are otherwise engaged 
in the collection of charges for services to a patient/ 
client shall not, by virtue thereof alone, have access to 
confidential records and information, except with re- 
spect to names, addresses, and other information es- 
sential to the preparation and submission of bills and 
claims for payment of charges for services to a patient/ 
client. 

(b) Clinical supervisors or trainers not employed by the 
service-providing facility: Confidential information 
may be disclosed to supervising or training clinicians 
by service providers who are in training or supervision 
under a clinician or bona fide training program, wheth- 
er or not such supervising clinicians are employed by 
or affiliated with the service-providing facility. For 
purposes of this subsection (b), the clinical supervisor 
or trainer receiving such confidential information shall 
bear the same position and responsibility with regard 
to the protection thereof as the service provider. 

(c) Protection from serious injury or disease: The Abused 
and Neglected Child Reporting Act: Confidential in- 
formation may be disclosed, (i) in accordance with the 
provisions of the Abused and Neglected Child Report- 
ing Act; and (ii), when the statute creating a legislative 
commission delegates authority to study the needs of 
minors or incompetents, and to promote services for 



139 



367 



OFFICIAL ACTIONS 



Am J Psychiatry 136:1. January 1979 



the protection of the rights and interest of minors or 
incompetent persons who are in need of, or provided 
with medical, social and mental health services; sub- 
ject, however, to guidelines established by the direc- 
tor of the agency providing the service with respect to 
the validity of the request for material and to the prop- 
er precaution as to its confidentiality and use. (iii) 
when and to the extent a treating or diagnosing service 
provider, in his sole discretion, determines that such 
disclosure is necessary to initiate or continue civil 
commitment proceedings under the laws of this state 
or to otherwise protect the patient/client or other per- 
son against a clear, imminent risk of serious physical 
or mental injury or disease or death being inflicted up- 
on the patient/client, or by the patient/client on him- 
self or another; and (iv) when and to the extent such is 
in the sole discretion of the treating or diagnosing cli- 
nician, necessary to the provision of emergency medi- 
cal care to a patient/client who is unable to assert or 
waive his rights hereunder and there is no relative or 
other third party available to give consent. Any per- 
son, institution, or agency, under this Act, participat- 
ing in good faith in the making of a report under the 
Abused and Neglected Child Reporting Act, or in the 
disclosure of confidential information otherwise in ac- 
cordance with this provision, shall have immunity 
from any liability, civil, criminal or otherwise, that 
might result by reason of such action. 

(d) Billing and claims: Information supplied by a service 
provider to persons involved in the billing for, or col- 
lection of, charges for services, shall be limited to 
names, addresses, dates on which services were per- 
formed, and the amount of charges for such services, 
and shall not otherwise indicate the nature of the con- 
ditions for which services were provided. In the event 
of a claim in any civil action for payment for services, 
no other confidential information except names, ad- 
dresses, the dates on which services were rendered, 
and the amount of charges for such services shall be 
disclosed in pleadings and motions, except to the ex- 
tent necessary (i) to respond to a motion of the client 
for greater specificity, or (ii) to dispute a defense or 
counterclaim. 

(e) Patienllclient-liligant exception: Except as provided 
in paragraph (ii) of this subsection (e) 

(i) Confidential information may be disclosed in a 
civil or administrative proceeding in which the 
client introduces his physical, mental or emotion- 
al condition or any aspect of his diagnosis or treat- 
ment for such a condition as an element of his 
claim or defense if and only to the extent the court 
in which the proceedings have been brought, or, 
in the case of an administrative proceeding, the 
court to which an appeal or other action for re- 
view of an administrative determination may be 
taken, finds, after m camera examination of testi- 
mony or other evidence, that it is relevant, pro- 
bative, not unduly prejudicial or inflammatory, 
and otherwise clearly admissible; that other satis- 
factory evidence, such as the results of a present 
examination of the patient/client by an examining 
clinician other than the service provider, or stipu- 
lations of fact between the parties, are demonstra- 
bly unsatisfactory as evidence of the facts sought 
to be established by such evidence; and that dis- 
closure is more important to the interests of sub- 



stantial justice than protection from injury to the 
provider-patient/client relationship or to the pa- 
tient/client or others whom disclosure is likely to 
harm. No confidential communication between a 
service provider and a patient/client shall be 
deemed relevant for purposes of this sub-section, 
except the fact of treatment, the cost of treatment 
and the ultimate diagnosis unless the party seek- 
ing disclosure of the communication clearly estab- 
lishes in the trial court a compelling need for its 
production, 
(ii) This subsection (e) shall not apply to preclude the 
assertion of the confidentiality privilege as to con- 
fidential information disclosed in the course of 
any treatment of an abnormal mental or emotional 
condition 

(a) In any action brought or defended under the 
Divorce Act, or 

(b) In any action for damages for pain and suf- 
fering that does not include a claim for the 
treatment of such abnormal mental or emo- 
tional condition. 

(iii) Confidential information or records may be dis- 
closed in a civil proceeding after the patient/ 
client's death when the patient/clients physical or 
mental condition has been introduced as an ele- 
ment of a claim or defense by any party claiming 
or defending through or as a beneficiary of the pa- 
tient/client, provided the court finds, after in cam- 
era examination of the evidence, that it is rele- 
vant, probative, and otherwise cleariy admissible; 
that other satisfactory evidence, including stipula- 
tions of fact between the parties, is not available 
regarding the fact sought to be established by such 
evidence; and that disclosure is more important to 
the interests of substantial justice than protection 
from any injury which disclosure is likely to 
cause. 
(iv) In the event of a claim made or an action filed by a 
patientyclient, or, following the patient/client's 
death, by any party claiming as a beneficiary of 
the patient/client, for injury caused in the course 
of diagnosis or treatment of said patient/client, the 
service provider and other persons whose actions 
are alleged to have been the cause of injury may 
disclose pertinent confidential information to an 
attorney or attorneys engaged to render advice 
about and to provide representation in connection 
with such matter and to persons working under 
the supervision of such attorney or attorneys, and 
may testify as to the said information in any judi- 
cial or discovery proceeding for the purpose of 
preparing and presenting a defense against such 
claim or action, 
(f) Court-ordered examination: Communications made to 
or diagnoses and opinions made by a service provider 
in the course of examination ordered by a court for 
good cause shown may, if otherwise relevant and ad- 
missible, be disclosed in a judicial or administrative 
proceeding in which the patient/client is a party or in 
appropriate pretrial proceedings, provided such court 
has found that the patient/client has been as adequate- 
ly and as effectively as possible informed before sub- 
mitting to such examination that such communica- 
tions, diagnoses and opinions would not be consid- 
ered confidential or privileged. Such communications. 



140 



368 



Am J Psychiatry 136:1, January 1979 



OFFICIAL ACTIONS 



diagnoses and opinions shall be admissible only on is- 
sues germane to the said proceedings and involving 
the patient/client's physical or mental condition. 

5. Waiver: 

(a) Particular items of confidential information may be 
disclosed in judicial proceedings if the court in which 
the proceedings have been brought finds that the infor- 
mation is relevant and otherwise admissible and that 
the patient/client or his authorized representative has, 
without coercion, knowingly waived confidentiality by 
disclosing, or consenting to disclosure of, the sub- 
stance of such particular information. In the case of an 
administrative proceeding, prior to disclosure of con- 
fidential information, any dispute as to the issue of 
waiver of confidentiality shall be referred for determi- 
nation to the court to which an appeal from the admin- 
istrative ruling may be taken. 

(b) Disclosures that are privileged, disclosures made in 
the course of obtaining payment for treatment and re- 
lated services, and disclosures made in the interest of 
accomplishing a purpose for which the psycho- 
therapist was consulted are not waivers of con- 
fidentiality. 

(c) For purposes of this section 5, failure by the patient/ 
client or his authorized representative to assert the 
confidentiality of information in any proceeding in 
which he has the legal standing and opportunity to do 
so shall be deemed a consent. 

6. Rulings on Claims of Confidentiality: 

(a) In a ruling on an assertion of confidentiality to prevent 
disclosure in judicial or administrative proceedings, 
the court may not require disclosure of information as- 
serted to be confidential under the Act in order to rule 
on such assertion. 

(b) When neither the patient/client nor his authorized rep- 
resentative are parties to an administrative or judicial 
proceeding or they otherwise lack the opportunity to 
assert confidentiality, (i) any person asked in adminis- 
trative or judicial proceedings to disclose confidential 
information may assert its confidentiality; and, (ii) the 
presiding officer on his own motion or the motion of 
any party shall exclude such information. Such pre- 
siding officer may not exclude information under this 
section 6 if, (i) he is otherwise instructed by the client 
or his authorized representative to permit disclosure; 
or, (ii) the proponent of the evidence establishes that 
there is no person authorized to assert confidentiality 
in existence. 

(c) Whenever confidentiality is asserted under this Act in 
a judicial or administrative proceeding, the party op- 
posing such assertion shall have both the burden of 
going forward with evidence and the burden of proof 
with regard to issues of whether confidentiality has 
been waived and whether any relevant transmissions 
of information were not made in confidence. 

(d) No person shall be held in contempt for failure to dis- 
close confidential information unless he has failed to 
comply with a court order, a legislative subpoena or 
an order of an administrative hearing that he disclose 
such information. 

7. Prescriptions: 

Nothing in this Act shall be construed as limiting or inter- 
fering with state and federal regulation and monitoring of the 



handling and dispensing of prescription drugs; otherwise, 
however, prescriptions for drugs shall be considered con- 
fidential information and subject to the provision of this Act. 

8. Research: 

Persons engaged in research may have access to con- 
fidential information that identifies the patient/client where 
needed for such research, provided no records thereof shall 
be removed from the service-providing faciUty that prepared 
them. Data that do not identify patient/clients or coded data 
may be removed from a service-providing facility provided 
the key to such code shall remain on the premises of the 
facility and no copies thereof are removed. Where the per- 
son engaged in research is to have access to confidential in- 
formation, the research plan first shall be submitted to, and 
approved by, an appropriate Research Review Committee 
and by the director of the service-providing facility or his 
designee. The service-providing facility, together with the 
person doing the research, shall be responsible for the pres- 
ervation of the anonymity of the patient/clients and shall not 
disseminate data that identify a patient/client except as pro- 
vided by this Act. 

9. Mandatory Cautions: 

(a) All nonoral disclosures of confidential information 
shall bear the following statement: "The protection of 
the confidentiality of information contained herein is 
required under (chapter) of laws of the State of 
( ) which provides for damages and penalties 
for violations. This material shall not be transmitted to 
anyone without consent or other authorization as pro- 
vided in the aforementioned statute." A copy of the 
pertinent consent form specifying to whom and for 
what specific use such communication or record is dis- 
closed or transmitted, or a statement setting forth any 
other statutory authorization for disclosure or trans- 
mittal and limitations imposed thereon, shall accom- 
pany all such nonoral disclosures. In cases of oral dis- 
closure, the person disclosing confidential information 
shall inform the recipient that such information is con- 
fidential under the laws of this state. 

(b) Service providers shall ensure that all persons in their 
employ or under their supervision are aware of their 
responsibilities to maintain the confidentiality of infor- 
mation protected by this Act and of the existence of 
penalties and civil liabilities for violation of this Act. 

10. Civil Remedies and Criminal Penalties: 

(a) Any person aggrieved by a violation of this Act may 
petition the court of common pleas for the county in 
which he or the alleged violator resides or in which 
such violation occurred, for appropriate relief, includ- 
ing temporary and permanent injunctions, and such 
petition shall be first priority with respect to assign- 
ment for trial. Such aggrieved person may also prove a 
cause of action for general or special damages, or 
both, and, in cases of willful or grossly negligent viola- 
tions, punitive damages. 

(b) A willful or grossly negligent violation of this Act shall 
be punishable as a Class C misdemeanor. For pur- 
poses of this section, in cases of willful disclosure of 
confidential information, each such disclosure of in- 
formation pertaining to any one person shall constitute 
a separate violation. 

141 



369 



OFFICIAL ACTIONS 



Am J Psychiatry 136:1, January 1979 



1 1 . Employee Discipline: 

(a) Any state, county or local government employee and 
any employee of a service-providing facility operated 
under contract to a state, county or local government 
or department or agency thereof, who repeatedly, 
willfully or through gross negligence violates this Act, 
shall be dismissed from employment, or, in the case of 
mitigating circumstances deemed adequate by the em- 
ployer, appropriately disciphned and transferred to a 
position, if available and otherwise suitable, outside a 
service-providing facility and involving no access to 
confidential information. 

(b) Negligent, nonrepetitive violations of this Act shall 
render such employees subject to appropriate dis- 
ciplinary action. 

(c) In the course of any disciplinary or dismissal actions 
against such employees, confidential information shall 
not be used except to the extent necessary to comply 
with principles of fair notice and hearing, and patient/ 
client identifiers shall be removed from any such infor- 
mation prior to its use in such proceedings. 

(d) All contracts between private persons and any state, 
county or local government or department or agency 
thereof involving access by such private persons or 
their employees, representatives, agents or subcon- 
tractors shall include a provision setting forth require- 
ments of this section. Failure to include this clause in 
any such contract shall not limit the operation of this 
section. 

12. PalienllClient Access to Information: 

(a) Except as provided in (c) and (d) of this section 12, 
upon request of a patient/client, a service provider 
shall, within thirty days following the request, allow 
the patient/client access to his service record. 

(b) The service provider shall establish procedures that; 
I ) allow a person to purchase copies of his record at a 
reasonable cost, not exceeding the actual cost of du- 
plication to the service provider; 2) allow a person to 
contest the accuracy, completeness or relevancy of 
the record content; 3) allow information contained 
therein to be corrected on request of the person when 
the service provider concurs in the proposed correc- 
tion; 4) allow a person who believes that the service 
provider maintstins inaccurate or incomplete informa- 
tion concerning him to add a statement to the record 
setting forth what he believes to be an accurate or 
complete version of those personal data. Such a state- 
ment shall become a permanent part of the service 
provider's personal data system, and shall be dis- 
closed to any individual, agency or organization to 
which the disputed personal data are disclosed. 

(c) If a service provider determines that disclosure to a 
person of medical, psychiatric or psychological data 
concerning him would be detrimental to that person, 
or that nondisclosure to a person of personal data 
concerning him is otherwise required by law, the serv- 
ice provider may refuse to disclose those personal 
data, and shall refuse disclosure where required by 
law. In either case, the service provider shall advise 
that person of his right to appoint another clinician of 
his own choice as "clinical mediator" to have access 
to the record. The "clinical mediator" may, upon re- 
view of the record, disclose the record to the person, 
offer to interpret the contents of the record to the per- 



son, or may refuse to disclose. If the "clinical media- 
tor" determines against disclosure and the person is 
unwiUing to accept an interpretation of his record, the 
service provider shall advise the person of his right to 
seek judicial relief. 

(d) If disclosure of personal data is refused by a service 
provider under this section 12, the person aggrieved 
thereby may, within 30 days of such refusal, petition 
the court of common pleas for the county or judicial 
district in which he resides or in which the service pro- 
vider resides or practices, for an order requiring the 
service provider to disclose the personal data. The 
court, after hearing and an in camera review of the 
personal data in question, shall issue the order re- 
quested unless it determines that such disclosure 
would be detrimental to the person or is otherwise 
prohibited by law. or may alternatively authorize dis- 
closure to a designated clinician or attorney. 

(e) If the person is under 12 years of age, his parent or 
other custodian shall have the rights set forth in this 
section 12 on behalf of that person. Further, if the per- 
son, in consequence of physical or mental incapacity, 
shall have been placed under guardianship, his guard- 
ian shall have the same rights set forth in this section 
12 on behalf of that person. 

13. Records and Information Pertaining to Minors: 

(a) All confidential information pertaining to the provision 
of health and social services to a minor shall be 
deemed confidential, and no disclosure of such infor- 
mation shall be made to the child's parent or any other 
person, except: 
(i) If a minor who is twelve (12) years of age or older 

consents in writing; 
(ii) As provided by sections 4 and 12 (c) hereof; 
(iii) If the service provider obtains information that he 
or she believes requires action to prevent serious 
harm to the minor or another person, he or she 
may disclose that information t& the child's par- 
ent, guardian or legal custodian, or as appropriate 
under the provisions of the Abused and Neglected 
Child Reporting Act: 
(iv) All records shall be available to the child's coun- 
sel of record and professional and paraprofession- 
al persons associated with the child's counsel and 
to staff members of the Juvenile Court. 

14. Personal Notes: Special Limitations on Disclosure: 

(a) A service provider is not required to but may, to the 
extent he or she determines it necessary and appropri- 
ate, keep personal notes regarding a patient/client 
wherein he or she may record: 

(i) Sensitive information disclosed to him or her in 
confidence by other persons on condition that 
such information would never be disclosed to the 
patient/client or other persons; 
(ii) Sensitive information disclosed to him or her by 
the patient/client that would be injurious to the pa- 
tient/client's relationships to other persons; and 
(iii) The service provider's speculations, impressions, 
hunches and reminders. 

(b) Such personal notes are the work product and person- 
al property of the service provider and shall not be 
subject to discovery in any judicial, administrative or 
legislative proceeding or any proceeding preliminary 
thereto. 



142 



370 



Am J Psychiatry 136:1, January 1979 



OFFICIAL ACTIONS 



15. Group Health and Life Insurance: 

No person shall demand or request that information as to 
medical and mental health history, condition and treatment 
on group health and group life insurance applications, ques- 
tionnaires and claim forins or any copy thereof or informa- 
tion therefrom, be submitted to an insurance company re- 
garding the insurance coverage of a resident of this state, (a) 
to or through any member or representative of the group, or 
(b) to or through the employer or any representative or agent 
of the employer of the persons covered by such policy, but 
only directly from the insured or covered persons or their 
designees and providers of covered health care services or 
their designees. Insurance companies with group policies 
covering persons residing in this state and the representa- 
tives and agents of such companies, in accordance with rules 
and regulations to be promulgated by the Director of Insur- 
ance, shall, within 120 days from the effective date of this 
Act (a) take measures to advise group members, employers 
of group members and representatives and agents of such 
employers involved in the administration of such policies of 
the requirements of this section; (b) cause notices regarding 
this section to be printed prominently on all newly issued or 
renewal policies, on printed materials intended to be pro- 
vided to group members and their employers regarding such 
policies and on all applications, questionnaires, claims and 
similar forms to be submitted by or on behalf of covered per- 
sons and by persons providing covered health care services. 
For purposes of this section, covered health care services 
shall include diagnostic and evaluative services. This section 
shall not apply to applications for life insurance benefit pay- 
ments. 

16. Health and Life Insurance: Prohibition on Requirement 
of Consent to Disclosure by Insurance Company to Others: 

No insurance company or any employee, representative 
or agent thereof shall require of any person residing in this 
state as a condition of the issuance, continuation, renewal or 
reinstatement of life, health, accident, medical, hospital- 
ization or similar insurance policy or as a condition of paying 
any benefits thereunder that an applicant, insured or covered 
person, or any person acting in his behalf, authorize or agree 
to authorize such insurance company to disclose or re-dis- 
close confidential information with patientydient identifiers 
to persons other than itself. Advice that no such requirement 
may lawfully be imposed must be given in conjunction with 
any request for such authorization. 

17. Slate, County and Local Information Systems: 

(a) Official inspections: Nothing in this Act shall be con- 
strued as prohibiting any state, county or local govern- 
ment official from performing any audits, investiga- 
tions or inspections of health or social service facilities 
in the state as required or authorized by \z'*i, provided 
that the performance of such duties shall not entail re- 
moval from any such facility of any confidential infor- 
mation with client identifiers or any codes or keys to 
electronically processed information. 

(b) Statistical reports: Nothing in this Act shall be con- 
strued as prohibiting the issuance of statistical reports 
and similar anonymous data regarding the operations 
of health or social service facilities. 

(c) Electronic data processing: 

(i) No electronically processed data of confidential 
information with patient/client identifiers shall be 
recorded on equipment outside a mental health fa- 



cility except in accordance with this section, 
(ii) Confidential information regarding current pa- 
tient/clients may be recorded on electronic data- 
processing equipment outside a mental health fa- 
cility only if: 

1 . Such information is encoded by means that 
make it impossible for persons other than data- 
processing personnel within such facility to dis- 
cern the identity of individual patient/clients; 

2. The encoding means or devices by which a 
patient/client can be identified are delivered, with- 
in 60 days after a client is discharged or otherwise 
ceases to participate in diagnosis or treatment, by 
data-processing personnel within such facility to a 
person or persons under the direct supervision of 
the facility director, which person or persons are 
strictly denied access to the electronic data-proc- 
essing equipment and are responsible for the safe- 
keeping of such encoding means or devices and 
the denial of access thereto to all persons except 
as provided in subsection (iii) of this section 17; 

3. The encoding means or devices by which a 
former patient/client can be identified may be re- 
turned to data-processing personnel for purposes 
of reactivating access to confidential information 
stored on electronic data-processing equipment 
when and only when, (1) the patient/client to 
which such information pertains has reentered di- 
agnosis or treatment at such facility, or (2) a 
request for confidential information that may be 
honored under the provisions of this Act has been 
received; and 

4. No later than 5 years after a patient/client 
has been discharged or has otherwise ceased to 
receive services at such facility, or in the case of a 
minor receiving service that was terminated dur- 
ing his minority, no later than 5 years after attain- 
ing his majority, either said encoding means or de- 
vices pertaining to such patient/client shall be de- 
stroyed, or, (2) all electronically processed data 
pertaining to such patient/client shall be returned 
to data personnel at such facility. Those facilities 
planning long-term epidemiological research may 
request under the research provisions of this stat- 
ute special informed consent from the patient/ 
client or authorized representative to maintain the 
patient/client's records fer an extended period of 
time. Treatment may not be denied for failure to 
consent. The patient/client may at any time jancel 
consent without prejudice. 

(iii) Such encoding means or devices may be disclosed 
(aa) to the extent necessary for auditors regularly 
employed by the state to inspect electronic data 
equipment to ensure strict and complete com- 
pliance with this Act, provided that such in- 
spections shall not involve the removal of such 
encoded means and devices, or copies or other re- 
productions thereof from a mental health facility, 
(bb) or to the extent required for a fair hearing in 
connection with the dismissal of an employee 
charged with violating this Act, and (cc) to the ex- 
tent necessary for use in a civil or criminal action 
arising out of violations of this Act. 
(d) Indigency investigations: Any agency of state, county 
or local government charged with responsibility to in- 
vestigate or audit claims of indigency, hardship or sim- 



143 



371 



OFFICIAL ACTIONS 



Am J Psychiatry 136:1 , January 1979 



ilar status whereby individuals may receive health or 
social services without charge or on the basis of re- 
duced charges, shall maintain the confidentiality of the 
patient/clients in the conduct of such investigations or 
audits and, upon the completion thereof, shall forward 
a report to the facility or agency for which prepared 
and shall keep no record of such investigation by 
which any patientydient can be identified. 

18. Disclosures Required in Federally Funded Programs: 

(a) Confidential information may be disclosed to federal 
departments and agencies to the extent required under 
federal law to obtain reimbursement for diagnosis, 
treatment and other social services under federally 
funded programs for review and audit that are a requi- 
site for participation in federally funded programs. 

(b) Any organization or agency designated under federal 
law to perform such reviews or audits of the cases of 
patient/clients who are residents of this state shall 
maintain the confidentiality of confidential informa- 
tion, shall not disclose confidential information except 
to the extent required by federal law, and shall destroy 
the means by which patient/clients can be identified in 
such information and records containing such infor- 
mation at the earliest opportunity consistent with the 
requirements of federal law. 

(c) To ensure that confidential information regarding citi- 
zens and residents of this state is afforded maximum 
protection consistent with the provisions of this Act, 
the directors of each state code department delivering 
health or social services shall promulgate regulations 



that specify the minimum information required pur- 
suant to subsections (a) and (b) of this section 18 and 
disclosures in excess thereof shall constitute viola- 
tions of this Act. In the event a demand for con- 
fidential information in excess of that provided for in 
such regulations is made on any health or social serv- 
ice provider in this state upon pain of disallowance of 
reimbursement or other benefits, such provider shall 
immediately refer the matter to the director of the ap- 
propriate state code department or his designee, who 
shall, on behalf of such provider, attempt a resolution 
of the matter either by negotiation or appropriate 
court action, or by authorizing said provider to dis- 
close if he determines that disclosure is required by 
federal law. Disclosures pursuant to the preceding 
sentence shall not constitute violations of this Act if all 
reasonable measures to assure confidentiality are 
taken, 
(d) The director of each state code department delivering 
health or social services shall prepare written notices 
describing the requirements under any federally fund- 
ed programs for the disclosure of confidential informa- 
tion and the purposes for such access; and he shall 
promulgate regulations establishing procedures 
whereby each person being provided care or other 
services for which reimbursement will be sought 
through a federally funded program involving such 
disclosure will be given such notice at the outset of the 
delivery of services. Such notices shall provide advice 
regarding the individual's option not to receive treat- 
ment on a basis whereunder such disclosures are re- 
quired. 



144 



372 



Am J Psychiatry 136:1. January 1979 



OFFICIAL ACTIONS 



Commentary on Model Law on Confidentiality of Health and Social Service 
Records 



BY SANDRA NYE, J.D., M.S. W. 



This Model Act addresses and incorporates three allied le- 
gal concepts: confidentiality, privacy, and testimonial privi- 
lege. These are highly technical and frequently misunder- 
stood. Privilege is an evidentiary concept which provides an 
exception to the general principle of law that courts have the 
right to every man's evidence. The concept has relevance 
only in context of the testimonial arena. A testimonial privi- 
lege (or shield law) permits those protected by it to withhold 
testimony or records, notwithstanding a subpoena (1). The 
right to privacy protects the individual from unsolicited, un- 
warranted intrusion in the conduct and affairs of his life- 
including the right to keep to himself information about him- 
self (2). The right of a patient/client to confidentiality— and 
the concomitant duty of the care provider to maintain the 
patient/client's confidentiality— inheres in the contractual 
nature of the provider-patientydient relationship. Implied in 
the contract is a covenant not to disclose (3, 4). 

Part of the complexity of this Model Act arises by reason 
of the legal principles on which it is based and which it in- 
tends to alter. In overturning existing law, every detail to be 
changed must be explicated. Any concept not expressly al- 
tered will remain the law. Thus, the Model Act must not only 
create and articulate novel concepts and procedures but 
must expressly ehminate or alter existing ones. For example, 
it is clearly established by case interpretation of statutory or 
common law privileges that the identity of a patient/client, 
the fact of the professional relationship, and purely clerical 
data— such as dates of service delivery— are not privileged 
communications and are, therefore, not protected from com- 
pelled disclosure in a legal proceeding (5). Further, the pres- 
ence of a third person who is not a party to the provider- 
patient/client relationship (e.g., a family member or group 
member) "pollutes" any privilege that might have existed 
between the provider and the patient/client (6). Such techni- 
calities as these have severely curtailed the efficacy of the 
communications pn'vilege as a protection to psychiatric pa- 
tients. 

The Model Act is intended to serve as a basis for examin- 
ing and proposing changes in local legislation. Although it 
represents the product of a thorough study of this subject 
and the combined thinking and expertise of many learned 
professionals, there are doubtless aspects that may be im- 
proved. The caveat to be kept in mind in working with the 
Act is that much of its phraseology consists of "terms of 
art." A knowledgeable lawyer should be consulted in any 
redrafting effort. In the limited space available for annota- 
tion, it is not possible to provide thorough explication and 
legal authority. We ask that the reader take on faith, for the 
time being, that what appear to be redundancy, prolixity, or 



Ms. Nye is Assistant Professor, Department of Psychiatry, Univer- 
sity of Illinois Abraham Lincoln School of Medicine, and Director of 
L^al Affairs, Jewish Family and Community Services, I South 
Franklin St., Chicago. III. 60606. 



tortured sentence construction translates in "legalese" as 
meaningful. 

1. Scope. This Act defines both a communications privilege 
and a general law of confidential information. Thus, in addi- 
tion to protecting confidential information from compelled 
disclosure in a judicial, legislative, or administrative pro- 
ceeding, it also establishes a positive statutory duty on 
health and social service providers to maintain patientydient 
confidentiality. A salient principle of the Act is that all pa- 
tient/client information given for the purpose of health care 
and social service delivery must be protected— irrespective 
of the nature of service delivered or the discipline or profes- 
sional status of the care provider. This is a significant depar- 
ture from most existing law. which makes irrational dis- 
tinctions in protecting information as to care setting and care 
provider credentials. The needs of the patient/client for pri- 
vacy and confidentiality do not differ according to whether 
the care provider is a social worker, a paraprofessional, or a 
psychiatrist. It should be public policy to mitigate fear of 
stigmatization (said to be the greatest barrier to seeking men- 
tal health services) so as to encourage individuals to seek 
necessary health and mental health care and social services. 

2. Definitions. Explicit and detailed definitions are required 
to extend protection to categories of persons and data here- 
tofore excluded by common law principles and certain stat- 
utes. 

3. Authorized Disclosures. The nature of consent for dis- 
closure is defined and delimited. This section clears up many 
existing ambiguities and procedural questions and outlines in 
detail the rights and duties of persons seeking disclosure, of 
care providers, and of patientydients. 

The minimum age at which consent may be given is estab- 
lished as 12 years. This is consistent with current child de- 
velopment theory recognizing the privacy and con- 
fidentiality needs of adolescents receiving mental health 
treatment and with existing federal and state legislation au- 
thorizing persons of this age to consent to certain tj . .s of 
treatment and other services. It is to be noted that parental 
notification will be automatic in most cases simply by reason 
of the parent's initiation of or involvement in the service de- 
livered to the minor, or the minor's consent that disclosure 
be made to his/her parents. In the few cases in which the 
minor obtains services by reason of legal capacity to do so 
and does not authorize disclosure to his/her parents, the 
service provider who deems it necessary to notify the par- 
ents in order to protect the minor from serious injury or 
health hazard has the option under section 4 (c) to do so 
without the minor's consent or over his/her objection. 

4. Disclosures Without Authorization. Although the under- 
lying philosophy of the Act is that an individual has the right 
to control his/her private and confidential information, there 
is no question but that certain disclosures of such informa- 
tion are not only necessary but appropriate. In recognizing 
the "need to know, " the following principles are essential: 

a. Unauthorized disclosures should be kept to a mini- 



145 



373 



OFFICIAL ACTIONS 



Am J Psychiatry 136:1. January 1979 



mum, consistent with the needs of the patient/client 
and the exigencies of service delivery, 
b. The primary duty of the service provider is to the pa- 
tient/client. There is no July upon a provider to protect 
third parties, but there may be instances in which the 
provider deems it in the patient/client's interest to dis- 
close confidential information to protect the patient/ 
client or another from serious harm. This is left to the 
sole discretion of the service provider, who is immu- 
nized against liability for any such disclosure in good 
faith. 
The PatientlClient-Litigant Exception (subsection 4 (e)) is 
an almost universal exception to existing privilege laws. The 
adage that "confidentiality is to be a shield, not a sword" 
decrees that a patient/client waives any privilege he may 
have as to material relevant to the trial of a lawsuit in which 
he is a party. This section is based in peul on guidelines set 
forth by Judge Shirley Hufstedtler in her brilliant dissenting 
opinion inCaesarv. Mountanos (7). It further excludes from 
the rubric of "mental condition" an action for pain and suf- 
fering per se and incorporates a refinement of Illinois law 
eliminating the exception in divorce cases (8). Strictures are 
placed on disclosure after the death of the patient/client be- 
cause the threat of disclosure after death may serve to inhibit 
communications, particularly in mental health care delivery. 
This subsection clears up a problem presently existing in 
some jurisdictions that holds that the privilege expires with 
its holder. 

Court-ordered examination (subsection 4 (f)). Service pro- 
viders are frequently called upon to conduct examinations 
for trial purposes. Although clinical skills are utilized in such 
examinations, the information conveyed is intended to be 
disclosed, and communications made in the course of such 
examinations are not protected by a privilege. The relation- 
ship of examiner to the subject of the examination is not that 
of service provider and patient/client. Disclosure should, 
however, be limited in accordance with the purpose for 
which it is made. 

5. Waiver. At common law, a communication not expressly 
asserted by its holder is deemed waived. This section clari- 
fies the question of waiver and obviates certain "accidental" 
or "resulting" waivers. 

6. Ruling on Claims of Confidentiality. This section pro- 
tects, to the extent possible, confidential information during 
a controversy as to its discoverability or admissibility in a 
judicial or administrative proceeding. The person seeking 
disclosure has the burden of estabUshing discoverability or 
admissibility. The court is empowered to protect con- 
fidential information in appropriate cases in which there is no 
person in existence who is otherwise empowered to do so. 

7. Prescriptions. The patient/client's need for confidential- 
ity is balanced by the interest of the community in regulating 
drugs. 

8. Research. Although confidential information disclosed by 
a patient/client in the course of receiving health and social 
services is intended by the patient/client to be utilized for his 
direct benefit in service provision, the vjUue to the commu- 
nity in accessibility of data for research and development 
cannot be overlooked. This section provides access to data 
under strictures that will protect the patient/client. 

9. Mandatory Cautions. The disseminator of confidential in- 
formation is charged with the instruction of employees and 
disclosees as to the protection of the information he/she is 
disclosing. 

10. Remedies. Civil (equitable and legal) relief is authorized 
for any person aggrieved by violation of this Act. In some 



jurisdictions violations of confidentiality statutes have been 
discouraged by criminal sanctions as well. Alternatives are 
provided herein. 

11. Employee Discipline. This section is intended to enable 
employers to lake appropriate action against employees who 
willfully or by gross negligence violate the Act. Employers 
are said to fear that, without such provisions, civil service 
and union procedures will effectively preclude disciplinary 
action against erring employees who are employed under 
civil service regulations or union contracts and whose 
wrongful acts not only injure patient/clients but also expose 
the employers to liability. 

12. Patient/Client Access to Information. As a general prin- 
ciple, it is held that every person should have access to any 
record of information about him. If information is to be dis- 
closed pursuant to consent, such access is probably manda- 
tory. (Consent is not valid unless informed; one cannot give 
informed consent to disclose unless he/she 'has knowledge as 
to the content of the disclosure.) Further, a patient/client 
should have an opportunity and right to seek correction or at 
least enter his/her opinion into a record that contains an er- 
ror or with which he/she disagrees. Experience with allowing 
patient/client access to records has been positive. At the 
same time, some clinicians are concerned that there may be 
occasional instances in which the patient/client will be 
harmed by such access or the treatment process com- 
promised. A procedure is established that, although possibly 
cumbersome, will allow access as a general rule and will of- 
fer protection in cases in which the service provider deems 
access to be against the interest of the patient/client. 

13. See annotation to Section 3, supra. 

14. Personal Notes. This concept has been discussed for a 
number of years as a device by which clinicians can protect 
records of certain types of data (9). As the public insistence 
on patient/client right of access to records has grown, some 
care providers have been concerned about the effect on the 
individual who discovers unknown facts about him/herself or 
others or is exposed to speculations and interpretations of 
the clinician. Some information— although clinically rele- 
vant—may be so "sensitive" as to warrant exlcuding it from 
the case record entirely. Notes kept by the care provider for 
use in research, teaching, or supervision may contain materi- 
al that is inappropriate for the clinical record. Further, by 
reason of the nature of mental health treatment, certain rec- 
ord content may be highly prejudicial to the patient/client if 
disclosure is compelled in a judicial or other proceeding. 

The "personal notes ' concept borrows from a protection 
afforded "the work product of the attorney." Certain specif- 
ic types of material can be recorded in the clinician's "per- 
sonal notes, " which are to be utilized by the clinician for his/ 
her own purposes and may not be disclosed or discovered. 
Concern has been expressed by some administrators and at- 
torneys that this device will afford lazy, careless, or un- 
scrupulous care providers a means of "hiding their wrong- 
doings" or, at best, neglecting their recordkeeping. Although 
it is not possible to preclude wrongdoing on the part of any 
person who is so inclined, the language of the section is emi- 
nently plain and clear as to the limited usage of "personal 
notes." The value of the device in protecting patients and 
enhancing ser\'ice provision is deemed to outweigh any possi- 
ble misuse potential. 

15. Group Health and Life Insurance. Although the insur- 
ance industry denies the charge, there is a widespread belief 
that it is the major perpetrator of privacy and confidentiality 
offenses. In any case, care providers and patient/clients have 
expressed outrage over insurance company demands for in- 



146 



374 



Am J Psychiatry 136:1, January 1979 



OFFICIAL ACTIONS 



formation. A particular source of concern has been the prac- 
tice of claims processing through employers. This section es- 
tablishes parameters for data collection by insurors and re- 
quires that information about these parameters be supplied 
to the insured. 

16. Health and Life Insurance Disclosure of Information. 
Of the several insurance company practices objected to by 
providers and patient/clients, one of the most decried is the 
exchange and dissemination of data among insurors. The 
practice is widespread; the insurors insist they have a need 
and right to protect themselves. The many documented 
abuses of this practice lead to the conclusion that it must be 
curbed. The interests of the individual and the community in 
encouraging health care— and particularly mental health 
care— are held to outweigh the financial interest of the insur- 
ors. 

17. State. County and Local Information Systems. Elec- 
tronic data collection and storage is perceived as a threat to 
individual liberty (10). Despite the best intentioned efforts at 
safeguarding data banks, they are vulnerable to invasion and 
misuse. Rules for protecting patient/client privacy and con- 
fidentiality are established in the light of the realities of audit 
and accountability requirements. 

18. Disclosures Required in Federally Funded Programs. 
The practical exigencies of federal funding are recognized in 



this section, with safeguards established for confidential in- 
formation being disclosed. Notice to the patient/client rela- 
tive to disclosures and options is required. 



REFERENCES 

1. Slovenko R: Psychiatry and Law. Boston, Little, Brown and 
Co, 1973, p 61 

2. Perr I: Problems of confide'ntiality and privileged comniunica- 
tions in psychiatry. Leg Med Annu 1971, pp 327-341 

3. Hammonds v Aetna Casualty Surety Co, 243 F Supp 793 at 801 
(N D Ohio, 1965) 

4. Doe V Roe, 345 NYS 2d 560, affd 33 NY 2d 902, 352 NYS 2d 
626, 307 NE 2d 823, 20 ALR 3d 1 109 (1977) 

5. 97 CJS Witnesses, 283 

6. 81 Am Jur 2d Witnesses 

7. Caesar v Mountanos, 542 F 2d 1064 (9th Cir 1976) 

8. Beigler JS: The 1971 amendment of the Illinois statute on con- 
fidentiality: a new development in privilege law. Am J Psychia- 
try 129:311-315, 1972 

9. Jackson CBJ Jr: Consideration of the "active working record" 
versus the "permanent record." Psychiatric Opinion 12:29-33, 
1975 

10. Nycum SH; Computer abuses raise new legal problems. Ameri- 
can Bar Journal 61:444-448, 1975 



147 



375 

,/^„i J Fsychialry 136:1, January 1979 

EDITORIALS 



The APA Model Law on Confidentiality 



The Model Law on Confidentiality, prepared jointly by the APA Task 
Force on Confidentiality of Children's and Adolescents' Clinical Records and the 
APA Committee on Confidentiality and published elsewhere in this issue, is de- 
signed to serve as a prototype for potential enactment in the individual states. The 
model is broadly drawn; it applies to all medical, psychiatric, and social service 
records. Although some provisions may be considered controversial, each juris- 
diction can decide for itself which are desirable and/or enactable given the local 
legislative and professional ambience. 

The issues of privacy, confidentiality, and the privilege of communications be- 
tween physician and patient are in the public eye because of the impact of Water- 
gate, the EUsberg case, the report of the Privacy Protection Study Commission, 
the proliferation of linked data banks, and the encroachments on privacy by insur- 
ance carriers. Several independent groups have fashioned model laws on con- 
fidentiality. We believe the APA Model Law is at present most sophisticated from 
the point of view of our profession. 

A law on confidentiality has a much broader reach than does a law on privilege; 
the latter applies only to doctor-patient privilege in judicial, administrative, and 
legislative proceedings. Also, most privilege laws have so many exceptions as to 
be of limited value. A law on confidentiality, on the other hand, must consider the 
constitutional right to privacy, professional codes of ethics, confidentiality of ther- 
apist-patient communications, and rules and regulations regarding hospital rec- 
ords and other health care and social service information. The responsibilities of 
computer-bank technicians, researchers, insurance companies, and employers 
must be articulated to protect the privacy of the individual and yet recognize the 
valid requirements of society vis-a-vis scientific advance and business tech- 
nology. 

The APA Model Law on Confidentiality is a highly technical document and will 
require expert legal counsel to "translate" some of its provisions. For example. 
Section 2 on "Definitions" provides the basis for confidentiality to a degree that 
becomes apparent only as one studies carefully the remainder of the law. Section 
3 provides for informed consent in such a way that blanket consent forms cannot 
be used by insurance carriers; also, patients may revoke previous consent, and 
unauthorized redisclosures are prohibited. The insurance industry objects to these 
provisions on the basis of cost, but the public increasingly demands such pro- 
tection. Several reviewers of the Model Law have objected to the 12-year age of 
consent, believing this to be too low; others point out that age 7 is stipulated in 
federal regulations concerning human experimentation. Again, each jurisdiction 
can decide the specific age of consent according to a local consensus. 

Section 4, "Disclosures Without Authorization," is a particularly subtle section 
providing confidentiality guidelines in situations of training, audit, accreditation, 
billing, medical emergency, dangerousness, and litigation. Much case law and 
practical experience has been encompassed in drawing an optimal line between 
the needs for confidentiality and the legitimate needs of a complex society for 
information. Paragraph 4 (c) allows breaches of confidentiality for reporting child 
abuse and also to protect a patient or an intended victim from a dangerous act at 



71 



376 



the therapist's sole discretion. This is much different from the "duty to warn" 
interpreted to have been mandated by the Tarasoff decision. 

Paragraph 4 (e), "Patient/Client— Litigant Exception," protects communica- 
tions between a therapist and patient in Utigation. Provision is made for testimony 
by an examining clinician rather than the therapist unless there are unusual cir- 
cumstances; similarly, the content of the therapist-patient communications is pro- 
tected unless a compelling need for disclosure is proven. In contrast to most cur- 
rent laws, the balance is changed toward protecting patient-therapist communica- 
tion. Provision is also made to allow a clinician to defend himself in case of a 
malpractice action. Similarly, disclosures from a court-ordered psychiatric exami- 
nation are limited to the patient's clinical condition, thus precluding using the 
professional examination for a police function. 

particular current relevance is Section 7, "Prescriptions," which provides 
that prescriptions constitute confidential information and are thus subject to the 
Act, but that state and federal drug regulations and laws must be obeyed. 

Provisos for confidentiality in a research context have been resisted by epi- 
demiologists and statisticians. The Model Law draws the line at removing patient- 
identifiable confidential material from the facility providing service. Most statisti- 
cal and epidemiological research can be carried out through nonidentifiable data; 
research access to on-site identifiable data must be pre-reviewed by an appropri- 
ate research review committee. 

Penalties for unauthorized disclosures (Sections 10 and 11) are intended to un- 
derline the responsibility of professional and clerical personnel to recognize their 
responsibilities to maintain the confidentiality of patient records. There is some 
controversy over whether punitive as well as civil penalties are in order. The APA 
committees believe that punitive damages for willful or grossly negligent viola- 
tions of confidentiality are reasonable, but, again, local jurisdictions can modify 
these stipulations according to their own judgment. Hospital administrators will 
view provisions for damages with apprehension, but in our information-hungry 
society the balance of forces must emphasize the importance of privacy, and all 
personnel must be educated as to their responsibilities to protect the interests and 
privacy of the patient. The Denver State's Attorney demonstrated that the Factual 
Services Bureau fraudulently obtained sensitive medical information from hospi- 
tal and private office charts by impersonating medical personnel. Punitive penal- 
ties would help prevent such criminal activity. 

Another innovative and perhaps controversial section (Section 12) deah with 
access by patients to their clinical records. Current federal and state legislation as 
well as case law provides for access by consumers to data from which decisions 
modifying their lives may be made by others, such as credit agencies. However, 
when a physician determines that disclosure of clinical data would be detrimental 
to the patient, a hierarchy of procedures is established by which a patient may 
contest that determination. A "clinical mediator " clinician may be appointed by 
the patient to review the material; if he agrees with the original clinician that the 
information should not be disclosed, the persistent patient may go to court for a 
hearing and, if necessary, an in camera review of The data. 

Another precaution regarding such disclosures is provided in Section 14, "Per- 
sonal Notes." The concept of a work record of an attorney provides that a law- 
yer's personal notes regarding a client's case are not "discoverable" in the inter- 
est of establishing a circumstance under which a citizen may be free to disclose his 
troubles to a lawyer in his democratic self-interest. This concept is extended to the 
work record of a clinician, so that sensitive third-party information can be pro- 
tected, as well as his own speculations, impressions, and research data. Thus a 
chilling factor to his research and clinical interests is avoided. This is a pioneer 
concept and will have to stand the test of time. 

Section 15 provides for confidentiality of insurance records. There have been 
many instances of breach of privacy by employers and/or clerical personnel. Pro- 
vision is made for bypassing the employer's personnel office and direct communi- 
cation with the insurance companies. Section 16 prohibits unauthorized redisclo- 
sure by the insurance companies to other agencies such as the Medical Informa- 
tion Bureau. The insurance industry may well resist the enactment of these two 



72 



377 



sections and in most states may prevail, as they did this past year in Illinois when 
a Confidentiality Act containing most of the provisions of the APA Model Law 
was enacted. It is hoped that implementation of the recommendations of the Pri- 
vacy Protection Study Commission by Congress will neutralize this aspect of in- 
surance applications and claims. 

Sections 17 and 18 formulate guidelines for state, county, local, and federal 
agencies in performing audits, inspections, and investigations. There have been 
many instances in which auditors and police agencies have demanded access to 
sensitive records, thereby destroying the effectiveness of psychiatric and drug- 
abuse clinics. The principle has been established that funding per se does not 
entitle complete access to identifiable clinical records. Government agents must 
become educated to their responsibility to protect the privacy of citizens, includ- 
ing those who receive agency largesse. 

Similar problems exist with data processing. Linkages of various data banks 
allow the profiling of private citizens to a surprising extent through use of Social 
Security or driver's license numbers. Paragraph 17 (c) has been designed to help 
counter such unauthorized invasions of privacy. At present most government 
agencies will resist such attempts at regulation, but, again, it is a matter of per- 
sistent education of the consumer, the profession, and the bureau. 

In some states the APA Model Law will represent such a radical advance that it 
will not be enactable at present. As already noted, in Illinois most of the model 
has been enacted, even though it was necessary to omit the section dealing with 
insurance matters because of the effectiveness of the insurance industry lobby in 
order to save the remainder of the bill. Similarly, it was necessary to provide 
access to the state's attorneys for investigative purposes, but with the proviso that 
unauthorized redisclosure is prohibited. It is also of interest that similar legislation 
was recently introduced into Congress as S 3450 under the joint sponsorship of 
Senators Javits, Muskie, and Ribicoff. 

Because of the public's interest in preserving privacy, it has been predicted that 
in ten years all states will have privacy laws. Psychiatrists, because they are par- 
ticularly sensitive to confidentiality as a prerequisite to the effectiveness of their 
work, are among the leaders in effectuating such legislation. The APA Model Law 
incorporates our expertise. Most lawyers will be opposed to many of its provi- 
sions. Just as we require confidentiality for our work, lawyers require complete 
■ discovery of information. Our professional interests are antithetical but are sub- 
ject to education, negotiation, legislation, and litigation. It is in the interesfof 
society, our patients, and our profession that confidentiality laws be enacted in 
each state. The Model Law can serve as a protot>'pe lending itself to local modifi- 
cations. The APA Committee is available for consultation. 

Jerome S. Beigler, M.D. 



Dr. Beigler is Chairperson, APA Committee on Confidentiality, and President, 
Illinois Psychiatric Society, 55 East Monroe St., Suite 3510, Chicago, III. 60603. 



73 



378 




MENTAL HEALTH AND DEVELOPMENTAL 
DISABILITIES CONFIDENTIALITY ACT 



Effective January 1 , 1 979 



State of Illinois 

Department of Mental Health and 

Developmental Disabilities 



379 



MENTAL HEALTH AND DEVELOPMENTAL DISABILITIES 

CONFIDENTIALITY ACT 

AN ACT to protect the confidentiality of records and communications of 
recipients of mental health or developmental disability services, and to 
amend and repeal certain Acts and Sections herein named in connection 
..therewith . 

Be it enacted by the People of the State of Illinois, represented in the 
General Assembly: 



ARTICLE I 

Section 1. This Act shall be known and may be cited as the "Mental 
Health and Developmental Disabilities Confidentiality Act". 

Section 2. The terms used in this Act, unless the context requires 
otherwise, have the meanings ascribed to them in this Section. 

(1) "Confidential communication" or "communication" means any 
communication made by a recipient or other person to a therapist or to or in the 
presence of other persons during or in connection with providing mental health 
or developmental disability services to a recipient. Communication includes 
information which indicates that a person is a recipient. 

(2) "Guardian" means a legally appointed guardian or conservator of 
the person. 

(3) "Mental health or developmental disabilities services" or "ser- 
vices" includes but is not limited to examination, diagnosis, evaluation, 
treatment, training, pharmaceuticals, aftercare, habilitation or rehabilitation. 

(4) "Personal notes" means: 

(i) information disclosed to the therapist in confidence by other persons 
on condition that such information would never be disclosed to the recipient or 
other persons; 

(ii) information disclosed to the therapist by the recipient which would 
be injurious to the recipient's relationships to other persons, and 

(iii) the therapist's speculations, impressions, hunches, and reminders. 

(5) "Parent" means a parent or, in the absence of a parent or guardian, a 
person in loco parentis. 

(6) "Recipient" means a person who is receiving or has received mental 
health or developmental disabilities services. 

1 



56-421 O - 80 ~ 25 



380 



(7) "Record" means any record kept by a therapist or by an agency in 
the course of providing mental health or developmental disabilities service to a 
recipient concerning the recipient and the services provided. Record does not 
include the therapist's personal notes, if such notes are kept in the therapist's 
sole possession for his own personal use and are not disclosed to any other 
person, except the therapist's supervisor, consulting therapist or attorney. If at 
any time such notes are disclosed, they shall be considered part of the 
recipient's record for purposes of this Act. Record does not include testing 
material used in the course of providing services if the disclosure of such 
material would compromise the objectivity or fairness of the testing process. 

(8) "Record custodian" means a person responsible for maintaining a 
recipient's record. 

(9) "Therapist" means a psychiatrist, physician, psychologist, social 
worker, or nurse providing mental health or developmental disabilities services 
or any other person not prohibited by law from providing such services or from 
holding himself out as a therapist if the recipient reasonably believes that such 
person is permitted to do so. Therapist includes any successor of the therapist. 

Section 3. (a) All records and communications shall be confidential and 
shall not be disclosed except as provided in this Act. 

(b) A therapist is not required to but may, to the extent he determines it 
necessary and appropriate, keep personal notes regarding a recipient. Such 
personal notes are the work product and personal property of the therapist and 
shall not be subject to discovery in any judicial, administrative or legislative 
proceeding or any proceeding preliminary thereto. 

Section 4. (a) The following persons shall be entitled, upon request, to 
inspect and copy a recipient's record or any part thereof: 

(1) the parent or guardian of a recipient who is under 12 years of age; 

(2) the recipient if he is 12 years of age or older; 

(3) another person on such recipient's behalf if the recipient so author- 
izes in writing; 

(4) the parent or guardian of a recipient who is at least 1 2 but under 1 8 
years, if the recipient is informed and does not object or if the therapist does not 
find that there are compelling reasons for denying such access. The parent or 
guardian who is denied access by either the recipient or the therapist may 
petition a court for access to the record; or 

(5) the guardian of a recipient who is 18 years or older. 

(b) Assistance in interpreting the record may be provided without charge 
and shall be provided if the person inspecting the record is under 18 years of 
age. However, access may in no way be denied or limited if the person 
inspecting the record refuses such assistance. A reasonable fee may be charged 
for duplication of a record. 

(c) Any person entitled to access to a record under this Section may 



381 



submit a written statement concerning any disputed or new information, which 
statement shall be entered into the record. Whenever any disputed part of a 
record is disclosed, any submitted statement relating thereto shall accompany 
the disclosed part. Additionally, any person entitled to access may request 
modification of any part of the record which he believes is incorrect or 
misleading. If such request is refused, the person may seek a court order to 
compel modification. 

(d) Whenever access or modification is requested, the request and any 
action taken thereon shall be noted in the recipient's record. 

Section 5. (a) Except as provided in Sections 6 through 11 of this Act, 
records and communications may be disclosed only with the written consent of: 

(1) the parent or guardian of a recipient who is under 12 years; 

(2) both the parent or guardian of a recipient who is at least 12 but under 
18 years and the recipient. If only t\\p recipient refuses to consent there shall be 
no disclosure unless the therapist finds that such disclosure is in the best 
interests of such recipient. If the parent or guardian refuses to consent, 
disclosure shall not be made; or 

(3) the recipient if he is 18 years or older or his guardian if he has been 
adjudicated incompetent. 

(b) Every consent form shall be in writing and shall specify the follow- 
ing: 

(1) the person or agency to whom disclosure is to be made; 

(2) the purpose for which disclosure is to be made; » 

(3) the nature of the information to be disclosed; 

(4) the right to inspect and copy the information to be disclosed; 

(5) the consequences of a refusal to consent, if any; and 

(6) the fixed period of time for which the consent is valid; and 

(7) the right to revoke the consent at any time. 

The consent form shall be signed by the person entitled to give consent and 
the signature shall be witnessed by a person who can attest to the identity of the 
person so entitled. A copy of the consent and a notation as to any action taken 
thereon shall be entered in the recipient's record. 

(c) Only information relevant to the purpose for which disclosure is 
sought may be disclosed. Blanket consent to the disclosure of unspecified 
information shall not be valid. Advance consent may be valid only if the nature 
of the information to be disclosed is specified in detail and the duration of the 
consent is indicated. Consent may be revoked in writing at any time; any such 
revocation shall have no effect on disclosures made prior thereto. 

(d) No person or agency to whom any information is disclosed under this 

3 



382 



Section may redisclose such information unless the person who consented to 
the disclosure specifically consents to such redisclosure. 

(e) Except as otherwise provided in this Act, records and communica- 
tions shall remain confidential after the death of a recipient and shall not be 
disclosed unless the recipient's representative, as defined in the Probate Act of 
1975, approved August 7, 1975, as now or hereafter amended, and the therapist 
consent to such disclosure or unless disclosure is authorized by court order after 
in camera examination and upon good cause shown. 

(f) Paragraphs (a) through (e) of this Section shall not apply to and shall 
not be construed to limit insurance companies writing Life, Accident or Health 
insurance as defined in Section 4 of the Illinois Insurance Code, as now or 
hereafter amended, and Non-Profit Health Care Service Plan Corporations, 
writing Health Care Service contracts, under The Non-profit Health Care 
Service Plan Act, as now or hereafter amended, in obtaining general consents 
for the release to them or their designated representatives of any and all 
confidential communications and records kept by agencies, hospitals, therapists 
or record custodians, and utilizing such information in connection with the 
underwriting of applications for coverage for such policies or contracts, or in 
connection with evaluating claims or liability under such policies or contracts, 
or coordinating benefits pursuant to policy or contract provisions. 

Section 6. Such information from a recipient's record as is necessary to 
enable him to apply for or receive benefits may be disclosed with consent 
obtained pursuant to Section 5 of this Act. Disclosure may be made without 
consent when despite every reasonable effort it is not possible to obtain consent 
because the person entitled to give consent is not capable of consenting or is not 
available to do so. The recipient shall be informed of any disclosure made 
without consent . The information disclosed without consent under this Section 
may include only the identity of the recipient and therapist and a description of 
the nature, purpose, quantity, and date of the services provided. Any request 
for additional information shall state with particularity what further information 
is needed and the reasons therefor. Refusal to consent to the disclosure of more 
information than is necessary to apply for or receive direct benefits shall not be 
grounds for in any way denying, limiting, or cancelling such benefits or 
refusing to accept an application or renew such benefits. Such information shall 
not be redisclosed except with the consent of the person entitled to give 
consent. 

Section 7. When a therapist or agency which provides services is being 
reviewed for purposes of funding, accreditation, audit, licensure, statistical 
compilation, research, evaluation, or other similar purpose, a recipient's record 
may be used by the person conducting the review to the extent that this is 
necessary to accomplish the purpose of the review, provided that personally 
identifiable data is removed from the record prior to the use. Personally 
identifiable data may be disclosed only with the consent obtained pursuant to 
Section 5 of this Act. Funding, accreditation, licensure, and the like may not be 
withheld or withdrawn for failure to disclose personally identifiable data if 
consent is not obtained. 



383 



Section 8. In the course of an investigation, a regional human rights 
authority of the Guardianship and Mental Health Advocacy Commission 
created by the Guardianship and Mental Health Advocacy Act enacted by the 
80th General Assembly may inspect and copy any recipient's records in the 
possession of a therapist or agency which provides services. However, a 
regional authority may not inspect or copy records containing personally 
identifiable data which cannot be removed without imposing an unreasonable 
burden on the therapist or agency which provides services, except as provided 
herein. The regional authority shall give written notice to the person entitled to 
give consent for the identifiable recipient of services under Section 4 that it is 
conducting an investigation and indicating the nature and purpose of the 
investigation and the need to inspect and copy the recipient's record. If the 
person notified objects in writing to such inspection and copying, the regional 
authority may not inspect or copy the record. The therapist or agency which 
provides services may not object on behalf of a recipient. 

Section 9. (a) In the course of providing services, a therapist may 
disclose a record or communications without consent to: 

(1) the therapist's supervisor, a consulting therapist, members of a staff 
team participating in the provision of services, a record custodian, or a person 
acting under the supervision and control of the therapist; 

(2) persons conducting a peer review of the services being provided; and 

(3) an attorney or advocate consulted by a therapist or agency which 
provides services concerning the therapist's or agency's legal rights or duties in 
relation to the recipient and the services being provided. 

Information may be disclosed under this Section only to the extent that 
knowledge of the record or communications is essential to the purpose for 
which disclosure is made and only after the recipient is informed that such 
disclosure may be made. A person to whom disclosure is made under this 
Section shall not redisclose any information except as provided in this Act. 

Section 10. (a) Except as provided herein, in any civil, criminal, 
administrative, or legislative proceeding, or in any proceeding preliminary 
thereto, a recipient, and a therapist on behalf and in the interest of a recipient, 
has the privilege to refuse to disclose and to prevent the disclosure of the 
recipient's record or communications. 

(1) Records and communications may be disclosed in a civil or admin- 
istrative proceeding in which the recipient introduces his mental condition or 
any aspect of his services received for such condition as an element of his claim 
or defense, if and only to the extent the court in which the proceedings have 
been brought, or, in the case of an administrative proceeding, the court to 
which an appeal or other action for review of an administrative determination 
may be taken, finds, after in camera examination of testimony or other 
evidence, that it is relevant, probative, not unduly prejudicial or inflammatory, 
or otherwise clearly admissible; that other satisfactory evidence is demonstra- 
bly unsatisfactory as evidence of the facts sought to be established by such 
evidence; and that disclosure is more important to the interests of substantial 



384 



justice than protection from injury to the therapist-recipient relationship or to 
the recipient or other whom disclosure is likely to harm. No record or 
communication between a therapist and a recipient shall be deemed relevant for 
purposes of this subsection, except the fact of treatment, the cost of services 
and the ultimate diagnosis unless the party seeking disclosure of the commun- 
ication clearly establishes in the trial court a compelling need for its production. 
However, for purposes of this Act, in any action brought or defended under the 
"Illinois Marriage and Dissolution of Marriage Act", approved September 22, 
1977, as now or hereafter amended, or in any action in which pain and 
suflFering is an element of the claim, mental condition shall not be deemed to be 
introduced merely by making such claim and shall be deemed to be introduced 
only if the recipient or a witness on his behalf first testifies concerning the 
record or communication. 

(2) Records or communications may be disclosed in a civil proceeding 
after the recipient's death when the recipient's physical or mental condition has 
been introduced as an element of a claim or defense by any party claiming or 
defending through or as a beneficiary of the recipient, provided the court finds, 
after in camera examination of the evidence, that it is relevant, probative, and 
otherwise clearly admissible; that other satisfactory evidence is not available 
regarding the facts sought to be established by such evidence; and that 
disclosure is more important to the interests of substantial justice than protec- 
tion from any injury which disclosure is likely to cause. 

(3) In the event of a claim made or an action filed by a recip- 
ient, or, following the recipient's death, by any party claiming as a beneficiary 
of the recipient for injury caused in the course of providing services to such 
recipient, the therapist and other persons whose actions are alleged to have been 
the cause of injury may disclose pertinent records and communications to an 
attorney or attorneys engaged to render advice about and to provide represen- 
tation in connection with such matter and to persons working under the 
supervision of such attorney or attorneys, and may testify as to such records or 
communication in any administrative, judicial or discovery proceeding for the 
purpose of preparing and presenting a defense against such claim or action. 

(4) Records and communications made to or by a therapist in the course 
of examination ordered by a court for good cause shown may, if otherwise 
relevant and admissible, be disclosed in a judicial or administrative proceeding 
in which the recipient is a party or in appropriate pretrial proceedings, provided 
such court has found that the recipient has been as adequately and as effectively 
as possible informed before submitting to such examination that such records 
and communications would not be considered confidential or privileged. Such 
records and communications shall be admissible only as to issues involving tht 
recipient's physical or mental condition and only to the extent that these art, 
germane to such proceedings. *.^ 

(5) Records and communications may be disclosed in a proceeding 
under the Probate Act of 1975, approved August 7, 1975, as now or hereafter 
amended, to determine a recipient's competency or need for guardianship^ 
provided that the disclosure is made only with respect to that issue. 



385 



(6) Records and communications may be disclosed when such are made 
during treatment which the recipient is ordered to undergo to render him fit to 
stand trial on a criminal charge, provided that the disclosure is made only with 
respect to the issue of fitness to stand trial. 

(7) Records and communications of the recipient may be disclosed in 
any civil or administrative proceeding involving the validity of or benefits under 
a life, accident, health or disability insurance policy or certificate, or Health 
Care Service Plan Contract, insuring the recipient, but only if and to the extent 
that the recipient's mental condition, or treatment or services in connection 
therewith, is a material element of any claim or defense of any party, provided 
that information sought or disclosed shall not be redisclosed except in connec- 
tion with the proceeding in which disclosure is made. 

(8) Records or communications may be disclosed when such are relevant 
to a matter in issue in any action brought under this Act and proceedings 
preliminary thereto, provided that any information so disclosed shall not be 
utilized for any other purpose nor be redisclosed except in connection with such 
action or preliminary proceedings. 

(b) Before a disclosure is made under this Section, any party to the 
proceeding or any other interested person may request an in camera review of 
the record or communications to be disclosed. The court or agency conducting 
the proceeding may hold an in camera review on its own motion. When, 
contrary to the express wish of the recipient, the therapist asserts a privilege on 
behalf and in the interest of a recipient, the court may require that the therapist, 
in an in camera hearing, establish that disclosure is not in the best interest of the 
recipient. The court or agency may prevent disclosure or limit disclosure to the 
extent that other admissible evidence is sufficient to establish the facts in issue. 
The court or agency may enter such orders as may be necessary in order to 
protect the confidentiality, privacy, and safety of the recipient or of other 
persons. Any order to ciisclose or to not disclose shall be considered a final 
order for purposes of appeal and shall be subject to interlocutory appeal. 

Section 11. Records and communications may be disclosed, (i) in 
accordance with the provisions of the Abused and Neglected Child Reporting 
Act, approved June 26, 1975, as now or hereafter amended; (ii), when, and to 
the extent, a therapist, in his sole discretion, determines that such disclosure is 
necessary to initiate or continue civil commitment proceedings under the laws 
of this State or to otherwise protect the recipient or other person against a clear, 
imminent risk of serious physical or mental injury or disease or death being 
inflicted upon the recipient, or by the recipient on himself or another; (iii) when 
and to the extent such is, in the sole discretion of the therapist, necessary to the 
provision of emergency medical care to a recipient who is unable to assert or 
waiye his rights hereunder and there is no relative or other third party available 
to give consent; and (iv) in commitment proceedings under the "Mental Health 
and Developmental Disabilities Code", enacted by the 80th General Assembly, 
and proceedings and investigations preliminary thereto, to the State's Attorney 
^OT the county of residence of a person for whom involuntary or judicial 
admission is sought, or in which such person is found, or in which the facility is 



386 



located, provided that the information so disclosed shall not be utilized for any 
other purpose nor be redisclosed except in connection with such proceedings or 
investigations. Any person, institution, or agency, under this Act, participating 
in good faith in the making of a report under the Abused and Neglected Child 
Reporting Act, approved June 26, 1975, as now or hereafter amended, or in the 
disclosure of records and communications otherwise in accordance with this 
provision, shall have immunity from any liability, civil, criminal or otherwise, 
that might result by reason of such action. For the purpose of any proceeding, 
civil or criminal, arising out of a report or disclosure in accordance with this 
provision, the good faith of any person, institution, or agency so reporting or 
disclosing shall be presumed. 

Section 12. (a) If the United States Secret Service requests information 
from the Department of Mental Health and Developmental Disabilities relating 
to a specific recipient and the Director of the Department determines that 
disclosure of such information may be necessary to protect the life of a person 
under the protection of the Secret Service, only the following information may 
be disclosed: the recipient's name, address, and age and the date of any 
admission to or discharge from a Department facility. 

€ 

(b) The Department of Mental Health and Developmental Disabilities 
and all private hospitals are required, as hereafter described in this subsection, 
to furnish the Department of Law Enforcement only such information as may 
be required for the sole purpose of determining whether an individual who may 
be or may have been a patient is disqualified because of that status from 
receiving or retaining a Firearm Owner's Identification Card under subsection 
(e) of Section 8 of "An Act relating to the acquisition, possession and transfer 
of firearms and firearm ammunition", approved August 3, 1967, as amended. 
Any such information disclosed under this subsection shall remain privileged 
and confidential, and shall not be redisclosed nor utilized for any other purpose. 
The method of requiring the providing of such information shall guarantee that 
no information is released beyond what is necessary for this purpose. One 
acceptable method is that of periodically providing lists to the Department of 
Mental Health and Developmental Disabilities or any private hospital of 
Firearm Owner's Identification Card applicants on which the Department or 
hospital shall indicate the identities of those individuals who are to its 
knowledge disqualified from having a Firearm Owner's Identification Card for 
reasons described herein. The Department may provide for a centralized source 
of information for the State on this subject under its jurisdiction. 

For purposes of this subsection (b) only, the following terms shall have the 
meaning prescribed: 

(1) "Hospital" means only that type of institution which is providing 
full-time residential facilities and treatment for in-patients and excludes insti- 
tutions, such as community clinics, which only provide treatment to out-pa- 
tients. 

(2) "Patient" shall mean only a person who is an in-patient or resident 
of any hospital, not an out-patient or client seen solely for periodic consulta- 
tion. 

8 



387 

Section 13. Whenever disclosurd of a record or communication is made 
without consent pursuant to this Act or whenever a record is used pursuant to 
Sections 7 and 8 of this Act, a notation of the information disclosed and the 
purpose of such disclosure or use shall be noted in the recipient's record 
together with the date and the name of the person to whom disclosure was made 
or by whom the record was used. 

Section 14. Any agreement purporting to waive any of the provisions of 
this Act is void. 

Section 15. Any person aggrieved by a violation of this Act may sue for 
damages, an injunction, or other appropriate relief. Reasonable attorney's fees 
and costs may be awarded to the successful plaintiff in any action under this 
Act. 

Section 16. Any person who knowingly and wilfully violates any pro- 
vision of this Act is guilty of a Class A misdemeanor. 

Section 17. The Director of the Department of Mental Health and 
Developmental Disabilities shall adopt rules and regulations to implement this 
Act. 

This Act takes effect January 1, 1979. 

This Act amends the following: 

Chapter 51, Evidence, par. 5.1 ; 

Chapter 23, Charities and Public Welfare, "Social Workers Registration 

Act", par. 5320 (Note: Transferred to Ch. Ill, Professions and 

Occupations). 
Chapter 91 V2, Mental Health, "Psychologists Registration Act", par. 

406 (Note: Transferred to Ch. Ill, Professions and Occupations). 

This Act repeals par. 5.2 of Chapter 51, Evidence. 



388 



CONFIDENTIALITY AND 
THIRD PARTIES 



A Report of the APA Task Force on Confidentiality as It Relates to 
Third Parties 

Maurice Grossman, M.D., Chairperson 
Jack D. Barchas, M.D. 
Richard G. Johnson, M.D. 
Alan L. Krueger, M.D. 
Joseph Satten, M.D. 



Approved for publication by the Council on 
Professions and Associations 



Lewis L. Robbins, M.D., Chairperson 

Ruth Barnard, M.D. 

Robert S. Garber, M.D. 

Norman Q. Brill, M.D. 

William R. Sorum, M.D. 

Martin Booth, M.D. [Observer-Consultant) 

Harry H. Brunt, Jr., M.D. (Assembly Liaison) 

Donald W. Hammersley, M.D. [Staff Coordinator) 



American Psychiatric Association 

1700 Eighteenth Street, N.W. 

Washington, D.C. 20009 



389 



CONTENTS 

Introduction: General Principles Governing Confidentiality of 

Psychiatric Treatment and Disclosures to Third Parties ... iv 

Definition of Purpose 1 

Recommendations Regarding Education Coordination 
With Other Agencies and the Need for an 
Ongoing Group ^ 

Acknowledgements ^^ 

Appendices 

A. General Principles Governing Confidentiality 13 

B. Proposed Coding for Mental Disorders 14 

C. Position Statement on the Need for Preserving 
Confidentiality of Medical Records in Any National Health 
Care System 20 

D. Position Statement on The Role of Confidentiality in 
Volunteer Military Drug Abuse Treatment Programs 21 

E. Recommendations of the Task Force on Confidentiality as 
It Relates to Third Parties to the Council on Professions 

and Associations, October, 1971 23 

F. Principles Governing Confidentiality and Disclosures to 
Third Parties (September, 1973] 27 

G. Testimony (with Addenda] Submitted on Behalf of the 
American Psychiatric Association and the American 
Academy of Psychiatry and the Law on the Inclusion of a 
Strengthened Rule 504 (Psychotherapist-Patient Privilege] 

in the Federal Code of Evidence, H.R. 5463 36 

H. Samples of Reports from Psychiatrists of Injuries to 

Patients Resulting from Breaches of Confidentiality 53 



III 



390 



INTRODUCTION 

GENERAL PRINCIPLES GOVERNING CONFIDENTIALITY OF 
PSYCHIATRIC TREATMENT AND DISCLOSURES TO 
THIRD PARTIES 

The constitutional right to be secure in home and person is the basis 
of the general right to privacy all citizens are entitled to. In medicine 
this extends to the right of the patient to be secure in the privacy of 
his communications with his physician. In psychiatry, where it is the 
very essence of the profession to deal with the most private corners 
of the patient's personal life, security from abuses of privacy form a 
condition without which it would be difficult to practice psychiatry 
and psychotherapy at all. 

Thus there is concensus in the medical worid, the legal commu- 
nity and the general philosophy of our system of government that 
confidentiality of private communication is a right. In particular, 
psychiatric treatment requires a secure atmosphere of confidentiality 
in order to protect the patient's right to the pursuit of health and 
happiness. To create an affirmative and secure atmosphere of con- 
fidentiality will encourage individuals who need help to seek it with- 
out fear that there will be destructive disclosure to the rest of the 
community. In fact, the mere disclosure of the fact of psychiatric 
treatment is sometimes felt to be a hazard to the patient. Further, 
some diagnostic terms have discriminating social connotations and 
can cause injury to patients if made known to others. 

The patient himself bears some responsibility to protect his own 
rights. Our position as the patient's physician also makes us respon- 
sible for the preservation of confidentiality. This responsibility is 
even more crucial when the patient's ability to protect his confiden- 
tiality is impaired by temporary regression incident to the therapeutic 
process, by his psychological state of function, or when, under finan- 
cial duress, the patient permits release of information the conse- 
quences of which he only dimly perceives. 

The unfettered ability to maintain absolute confidentiality in 
psychiatry seems desirable. However, problems are created when 
third parties have legitimate ethical rights to some information about 
a patient, his treatment process, or even certain specific elements of 
the treatment itself. Balancing these conflicting interests thus be- 

iv 



391 



comes the task of the psychiatrist. We must protect the integrity of 
the psychiatric process and the patient's clear right to privacy. But 
we are also asked to recognize that some information, usually with 
the patient's consent, and for advantages important to the patient, 
may properly be released to third parties. Lastly, in certain rare and 
special cases, our obligation to society may supersede the patient's 
rights. 

Finding this balance is often not easy. It could be destructive to 
a patient to refuse to give information about him to a third party 
having a legitimate right to it. It would be destructive to the patient 
to reveal too much information. It would be extremely destructive 
to the treatment process also if the psychiatrist were knowingly to 
collude in a manipulation of facts. This search for the proper bal- 
ance is generally best carried out in cooperation and discussion with 
the patient in the course of which it is the psychiatrist's responsibil- 
ity to determine whether the patient's consent is truly informed and 
not based on either misunderstanding or coercion. 

Those rare and special circumstances in which a physician's 
obligation to consider hazards to society may outweigh obligation to 
preserve the privacy of the patient, are crises in which there is clear, 
present and extreme danger to life or limb directed by the patient 
toward others or self. Such crises are often technical treatment prob- 
lems and should, if possible, be handled within the context of treat- 
ment. Possibly outside consultation may be of help and should be care- 
fully considered. Once, however, if in the psychiatrist's judgment this 
extreme danger from the patient toward self or others can no longer 
be contained within the treatment, protection of the patient or others 
may require a breach of confidentiality. In these circumstances con- 
fidentiality should be broken only to the extent necessary. 

The principle that confidentiality should only be broken to the 
minimum degree necessary to achieve its desired end applies to all 
circumstances in which third parties have a legitimate right to infor- 
mation. These will be dealt with in turn. 

Among the most common third parties requesting information 
about the patient or his treatment are family members. Here the 
psychiatrist must judge whether the disclosure of information will 
work for or against the patient. Where families, spouses, parents or 
children are involved it is wise to spell out the standards of confiden- 
tiality in the earliest stages of treatment. Even when the decision is 
to withhold all information, the family should not be entirely ignored 
but should be helped with whatever support is appropriate, for the 
emotional state of the family often directly affects the patient and his 
treatment. 



392 



When schools become the requesting third parties the decision 
to disclose also rests on whether such disclosure works for or against 
the patient. Often a school will modify its program in a therapeutic 
way if given appropriate information by the psychiatrist. On the other 
hand, there is the complication that such information may find its 
way into permanent school records where it will eventually become 
out of date and may be available to personnel who do not have the 
benefit of direct consultation with the psychiatrist. The fate of infor- 
mation once it is released to a third party is a serious problem, and 
efforts must be made to see that confidential information released to 
one third party remains confidential with respect to other third parties. 

Employers become third parties requesting information in cer- 
tain occupations where emotional health is felt to be significant in 
carrying out responsibilities. Generally, psychiatric examination to 
determine suitability for employment should be carried out inde- 
pendently of treatment and the treating psychiatrist. The judgment 
in such employment situations should rest on observable job behavior 
and not on the fact that the employee is in treatment. The long run 
advantage is to the employer as well as the employee if indicated 
treatment is sought early, and it is counter-productive for both if the 
treatment process stigmatizes an employee or makes him vulnerable 
to dismissal. 

The second way in which an employer may request information 
about an employee's treatment comes from the fact that employers 
often pay a part or all of the employee's insurance premium. The 
employer, therefore, needs actuarial information about his employ- 
ees' use of the insurance program so he may have the data from the 
insurance carrier that determines premiums to be paid and the cost 
benefit of his employer insurance program. In such cases information 
given to employers (or labor unions) should be in the aggregate and 
should never reveal specific information about an individual em- 
ployee. Such aggregate data is sufficient for the purposes required 
and release of any more detailed information would constitute an 
unwarranted abrogation of confidentiality. 

This brings us to the most important third party, the insurance 
company. Persons enroll in insurance programs to protect their future 
health and welfare. It therefore follows that the insurance company 
ought to do nothing which would defeat this aim. On the other hand, 
the insurance company has the right and some might even argue the 
responsibility to see that claims are justified and appropriate. It 
should do so, however, always in a way which will not undermine 
the patient's health and welfare. Any patient receiving care from any 
system of paying should have access to all medical services without 
jeopardizing privacy or confidential relationships with physicians. 



VI 



393 



Some insurance contracts limit coverage to certain illnesses or 
certain time periods, therefore insurance companies are entitled to 
information about patients which is pertinent to these areas. Thus it 
is necessary in many contracts to demonstrate that an illness did not 
exist prior to the effective date of the policy. Usually an indication 
that the patient had an illness which needs treatment is required. To 
substantiate the type and frequency of treatment given it may be 
necessary to give some information indicating the general degree of 
impairment the patient suffers unless treated. This information may 
be needed too for billing purposes. Finally, the fact that the patient 
suffers from a psychiatric condition covered by the contract may 
need to be stated. But in no case should a patient stricken by a condi- 
tion be penalized because he has added a "burden" to the group. 
Furthermore, when the cost accounting of a group is made the in- 
dividual's privacy should not be compromised and all data should be 
reported in the aggregate. The insurance companies' legitimate right 
to some information concerning patients is circumscribed. The precise 
diagnosis and even current "degree of disability" is probably not 
germane to the policy needs nor helpful to the insurance industry in 
answering the questions raised, when they follow the general medical 
model for actuarial purposes. They can usually be replaced by a gen- 
eral category of functional impairment. No information should be 
given which could in any way be used against the patient. Communi- 
cations by psychiatrists with an insurance company should be 
directly with its physician representative, thus subjecting the receiv- 
ing physician to the same ethical standards of confidentiality the 
treating physician has. If eHgibility to enroll in an insurance program 
is in question, as it often is in life insurance and some health insur- 
ance, the matter should be determined by an examination designed for 
that purpose, and not by information from the treating psychiatrist. 

Any national health insurance program should include strict 
safeguards of confidentiality built into any data collection or storage 
rfystem. We must assure that the minimum necessary demographic 
and health information about the individual be separated from na- 
tional health statistics. Accessibility to this data must be sharply and 
carefully limited. 

One special sub-category of confidentiality is that of privilege. 
Here the third party is the court and special legal parameters apply. 
While it is not necessary here to go into great detail about privilege, 
we do feel that many of the same principles governing confidentiality 
also apply to privilege. (For clarification of the distinction between 
confidentiality and privilege see "Position Statement on Guidelines 
for Psychiatrists: Problems in Confidentiality", American Journal of 
Psychiatry, 126:10, 187-193, April, 1970.) 



VII 



394 



When information is requested it is the psychiatrist's respon- 
sibility to explore with the patient the risks of breaking or relinquish- 
ing the privilege, and he should discuss the nature of the material 
which might be divulged. When asked to testify the psychiatrist must 
be one of the agents protecting the patient's best interests. If informa- 
tion is demanded and legal recourse has been exhausted, only that 
information specifically required should be revealed and no more. 
And we should as psychiatrists work for the establishment of priv- 
ileged statutes which will maximally protect a patient's privacy and 
the confidentiality of their treatment. 

From the foregoing some basic principles can be extracted. These 
are enumerated following. 



VIII 



\y 



395 



DEFINITION OF PURPOSE 

To determine the nature of problems threatening confidentiality be- 
tween patients and physicians, particularly through demands of third 
party interests. 

AREAS OF CONSIDERATION BY THE TASK FORCE 
Confidentiality and Insurance Coverage for Psychiatric Patients 

The Task Force on Confidentiality as Related to Third Parties 
(TFC) began conferences with Medical and Claims representatives 
of the insurance industry to study their legitimate needs for informa- 
tion and to examine with them the nature of psychiatric illness and 
treatment processes. Efforts were made in an attempt to reach an 
accord on the following aspects of this problem. 

New Code System. One important achievement of the TFC was 
the formulation of a new code for reporting psychiatric conditions to 
third party agencies for health insurance claims. The TFC met in 
May, 1971, with various insurance agency representatives, including 
a committee of medical directors (Life Insurance Medical Directors 
of America, LIMDA) and the Health Insurance Council (HIC). As a 
result, a new reporting system was designed using a specific code 
aimed at fulfilling insurance agencies' needs while not revealing un- 
necessary information which could be misused or otherwise be 
damaging. 

This new system of reporting was presented to the Council on 
Professions and Associations before being sent to all the District 
Branches in the U. S. and Canada for their examination and comment. 
Generally favorable and constructive suggestions were made, with 
the exception of a few that unrealistically advocated sending no in- 
formation at all. Following discussion by the Council, the Reference 
Committee and the speaker of the Assembly of District Branches and 
representatives of the Health Insurance Council arrangements were 
made and are currently underway for an actual trial in the field. (A 
copy of the working code system is attached as Appendix B.) 

Methods of Reporting to Insurance Companies. Much of the 
need for information by the industry is for the administration of the 
insurance contracts. Reimbursement of medical expenses and dis- 
ability payments, etc. depend on the nature and detail of different 
insurance contracts. There may be certain exclusions, and the date of 
onset is also important. For instance, benefits usually are limited to 



56-421 O - 80 — 26 



396 



Task Force Report 9 

actual onset during the period of employment. Another factor is the 
need for certain detailed data for the insurance company's actuarial 
department in determining risk factors in setting future premiums, 
and for predicting how much money would be set aside for reserve 
for claim payments. 

Basic information required. It is the opinion of the Task Force 
that insurance carriers could reasonably expect the provider [the 
treating psychiatrist, in this case) to supply the following information: 

1. Recognition that a psychiatric condition does exist. (In place of 
diagnosis, the new proposed code system would be used.) 

2. Approximate date that patient recognized symptoms and need for 
treatment, when asked "date of onset". (Note that Task Force is 
recommending that patients supply this, requiring review by the 
treating psychiatrist.) 

3. Nature of treatment in general terms. 

4. Billing which shows frequency, cost of treatment, and whether 
office, home, or hospital treatment, to support fees charged. 

It was agreed by the insurance industry representatives that 
when they need additional information, the medical director of the 
insurance company would write specifically to the physician involved 
asking specific questions and giving the reasons for needing this addi- 
tional information. The physician would not he in receipt of a form 
letter mailed by a clerk who has no knowledge of the problem. In 
addition, it was agreed that the reply to the letter would go directly 
to the medical director under his safeguarding of confidentiality. 

Limiting information given to the employer. The common prac- 
tice, particularly in employer-linked insurance coverage, of forward- 
ing sensitive information to employers was faced. This has been one 
of the most embarrassing and sometimes destructive abuses of con- 
fidentiality that our Task Force faced. Misuse of this personal and, 
at times, compromising material could have deep impact on an in- 
dividual's career, social, or personal life. Awareness of such a danger, 
has, in many instances, deterred individuals from seeking psychiatric 
help, even though this was a provision of the plan. This issue was 
extensively discussed in our May, 1971, workshop with the LIMDA, 
and, on a number of occasions with the HIC representatives. We met 
with the Medical Relations Committee of HIC in July, 1973, and this 
concern was reiterated. In our discussion with representatives of the 
Health Insurance Council, they agreed to seek methods of quarterly 
experience reports to employers that would omit any identifying data 
concerning the employee or employees involved in creating the ex- 
penses on the program. The industry indicates they are required to 
make such reports to employers to justify premium charges. They 



397 



CONFIDENTIALITY AND THIRD PARTIES 

were not able to justify having to supply the names of the employees 
involved. We had adamantly maintained a position that given all the 
arguments from the insurance industry, employers have no need for 
and should receive no data that cap be identified with a specific 
known employee. The problem of employer administered programs 
was discussed. They are a major source of patient information reach- 
ing the employer. As a result of our discussions, the AMA and the 
insurance industry have published agreements to discourage and 
hopefully to eliminate such programs eventually. 

Life insurance examinations limited to non-therapist physicians. 
The point was stressed with the insurance representatives that, if at 
all possible, examination and reporting for life insurance eligibility 
be done by a physician other than the treating psychiatrist. The in- 
surance representatives could understand that such a request for in- 
formation could jeopardize psychotherapeutic relationship. 

Concern with storage of sensitive information within the indus- 
try itseif. There has been considerable concern and question about 
insurance data banks, where allegedly confidential information is 
shared with other companies or organizations without patients' knowl- 
edge or consent. Although insurance industry representatives deny 
that this is a problem, documented cases have been received of in- 
stances of information being leaked accidentally or otherwise to 
patients and their relatives, of questionnaires requesting irrelevant 
information, and of use of the Retail Credit Bureau to investigate 
claims. Although HIC has given assurance that the RCB holds such 
information inviolate, complaints have been received that such in- 
vestigations have included questioning neighbors about the nature of 
illness, thereby disclosing that the patient has been in treatment and 
even hospitalized. Some complaints also indicate that health care 
data acquired for claim payment has been shared with other insur- 
ance companies for other purposes. 

Local Programs. Particular attention needs to be paid to the 
local administration of specialized insurance operations, such as 
CHAMPUS, an insurance program for the dependents of service per- 
sonnel. The Task Force has been concerned with limitations which 
need to be instituted regarding the information made available to 
central and clerical personnel and in one instance successfully inter- 
vened when a Blue Shield organization attempted to force compli- 
ance with a request to photocopy psychiatric records on CHAMPUS 
claims. 

"Consent to Release Information" Statement. 

Present forms are not informed consent. The Task Force has had 
great concern with the blanket release of sensitive information. 



398 



Task Force Report 9 

which has been the result of previous release policy. The patient 
often is not aware of, and therefore has not given informed consent 
to, the possible consequences of signing many of the present release 
forms. This is true also of the current AMA-approved changed form 
that differs in language, but not legal application, from the previously 
approved version. ("I hereby authorize the release of any medical 
information necessary to process this claim".) 

The Task Force again stated its objection to the consent state- 
ment on the basis that it is not informed consent for the following 
reasons: 

1. The patient does not know what is going to be released. 

2. There is no limitation as to whom the information may be dis- 
tributed once it is released. 

3. There is no limitation as to what is considered necessary, nor 
who determines that. 

4. It does not limit sources of information that then may be used for 
obtaining this vague concept of necessary information. 

Limitation on information release. The Task Force recommends 
that the APA adopt a position approving forms only if the consent to 
release information is limited to a specific recipient, a specific pur- 
pose, and a specific time (in place of the current blanket release]. 
There actually is nothing to prevent the patient from adding restric- 
tions to a consent form if the basic information needed by the insur- 
ance carrier is kept in mind as mentioned above. 

It was further recommended that the APA adopt a position en- 
couraging its members to refuse to channel any sensitive information 
through employers, and that reports to medical directors of insurance 
companies be noted, "Any divulgence to other parties or for any other 
purpose will constitute a breach of confidentiality and of medical 
ethics". 

National Health Insurance. Task Force investigation showed that 
none of the National Health Insurance plans had machinery for limit- 
ing the accumulation of medical data, nor for its protection from 
misuse. The APA issued a position paper for correcting this over- 
sight in December, 1971. (This is attached as Appendix C.) Our Task 
Force carried this to certain Senators and Representatives. This re- 
sulted in a strong section on confidentiality in the law establishing 
the Office of Drug Abuse. This, in turn, had effect on Senator Ervin 
and the Subcommittee on Constitutional Rights in their work on 
medical data banks and abuse of privacy. Also, a section on confiden- 
tiality was included in HR 1 (the bill which created the PSRO's in 
the Social Security program] as a result of these efforts. Plans were 
suggested for broader study of this problem. The Task Force estab- 



399 



CONFIDENTIALITY AND THIRD PARTIES 

lished machinery to deal with these problems through legislative 
offices, as well as local levels when indicated. 

These were two principles that the Task Force felt should be 
stressed. First, data required to assure an individual of medical care 
should be separated from the more complete and personal data 
needed for statistical purposes, administration or research. And, 
secondly, the data recorded should be protected from dissemination 
or misuse. Confidentiality of research data will depend on the mecha- 
nism and persons controlling the information machinery. 

Legal Aspects of Confidentiality as it Involves the Courts. 

Federal Codes of Evidence — Rule 504. Although many states 
have clear protection for physician- and/or psychotherapist-patient 
communications as part of their evidence codes thus creating priv- 
ileged communication, the future of the protection in the federal 
courts is less certain. Recently, the Federal Codes of Evidence have 
been under the process of revision, a step that requires Congressional 
approval of the final code. Initially, all medical privilege was ex- 
cluded. Then, psychotherapist privilege was reinstated. 

The Task Force on Confidentiality initiated conferences with 
legal authorities to study the problems involved, which led to devel- 
oping grounds for improving the protection. The information devel- 
oped and the contacts made were used via some District Branches 
and their Congressional representatives to change the definition of 
psychotherapist to include all physicians treating "mental and emo- 
tional disorders". While this was desirable in itself, it became even 
more important in January, 1973, when the American Medical Asso- 
ciation petitioned Congress to eliminate psychotherapist-patient priv- 
ilege from the proposed code. Again, through the machinery estab- 
lished by the Task Force — working through state medical societies, 
their delegates to the AMA, and various legal authorities — the AMA 
reversed itself, and so notified the relevant Congressional commit- 
tees. The Louisiana District Branch was particularly important in 
these endeavors. The proposed code is being evaluated by Congress, 
and will be rewritten. 

This threat to elimination of this protection has been diminished, 
but is not absent and the need to strengthen the protection as noted 
originally still exists. [See Appendix G.) Congress later did eliminate 
Rule 504, but some senators advocate that it be restored. 

Confidentiality as it involves the military drug-abuse program. 

In response to a formal request by Senator Harold Hughes for a 
statement from the APA concerning the effect of the confidentiality 
or lack of confidentiality in treatment and rehabilitation program for 



400 



Task Force Report 9 

drug users, our Task Force has prepared a draft of a position state- 
ment for the American Psychiatric Association, presented in Ap- 
pendix C. The statement was prepared after extensive discussions 
with persons involved in various aspects of such programs. The 
statement has three major thrusts: 

1. A nonpunitive program must be truly nonpunitive, and volunteer- 
ing for the program should grant protection for a confidential 
evaluation and on-going participation. 

2. Medical records should be held inviolate in the medical treatment 
sector. 

3. The patient's confidentiality should not be breached to civilian 
sources through the use of identifying codes, or through the co- 
mingling of personnel and medical records upon separation from 
the service. 

The preparation of the draft of the Task Force report, and con- 
tacts which were established with appropriate offices, had positive 
effects on the preparation of the regulations which were proposed by 
one of the three military departments. The Department of Defense 
has now decided to alter the use of SPN numbers to code behavior 
disorders among other items of reasons for discharge from service. 
These will no longer appear on any of the discharge papers available 
to the ex-military person or to employers. Reasons for discharge will 
be kept more securely in classified files. 

We would recommend the acceptance and publication of the 
current draft of the position paper, and continued ongoing contact 
with the Department of Defense in regard to these issues. 

Computer Bank Information and the Need for Increased Protection 
of Confidentiality. 

It has become apparent from numerous sources that there are 
in existence data banks which contain sensitive medical information 
for purposes ranging from insurance to national security. This trend 
would seem to require immediate, positive steps to provide mechan- 
isms of protecting confidential medical data. 

The Task Force has always urged upon the American Psychiatric 
Association that it consider the problem an ongoing one, and adopt 
an active approach to coping with it. 

In the fall of 1973 the Task Force in a report to the APA Council 
on Professions and Associations spelled out the need for a confer- 
ence to consider "gathering, storing, and retrieval in information sys- 
tems that would safeguard constitutional rights as well as the medi- 
cal need for confidentiality and the privacy of the individual". We 
noted at the time that "the problem is getting out of hand, and that 

6 



401 



CONFIDENTIALITY AND THIRD PARTIES 



the longer there is delay, the greater will be the problem in trying to 
institute a more acceptable system than is now growing by chance at 
its current explosive rate". 

Happily, the sense of urgency of the Task Force received the 
sympathetic attention of then APA President, Dr. Alfred M. Freed- 
man, the Medical Director, Dr. Walter E. Barton and others, who 
called together a representative group of national organization peo- 
ple to explore their common interests in this problem area. This led 
to more formal organization of a planning group, on which the Task 
Force Chairman served, to plan a major working Conference on the 
Confidentiality of Health Records with the cooperative participation 
of about 50 national organizations and agencies, representative of 
organized medicine and all of the major medical specialties, the in- 
surance industry, law, hospitals, nursing, medical record keeping, 
behavioral science, consumer groups, government, and many others. 
The need for consumer groups to participate in such efforts was 
paramount. 

The Conference was held at Key Biscayne, Florida, November 
6-9, 1974 after about six months of preparation in which many of the 
participating experts prepared working papers of high quality that 
were sent out to all participants in advance.* Approximately 110 
persons were in attendance. 

A full report of the important conference will be published by 
the Association in the spring of 1975. However, the most auspicious 
single result of the meeting was the unanimous resolution of all par- 
ticipants (with two abstentions) that there should be formed an in- 
dependently incorporated body tentatively titled National Commis- 
sion on the Confidentiality of and Access to Health Records to serve 
the following purposes: 

1. To promote and preserve the confidentiality of health care records 
and to establish guidelines and recommendations for appropriate 
access to them. 

2. To propose legislation and regulations to study and analyze legis- 
lation and regulations, in formation or already introduced, and to 
make recommendations for action and implementation by spon- 
soring organizations. 

3. To engage in educational activities serving as an information ex- 
change between participating organizations, to develop and/or 
disseminate materials for public education on confidentiaUty and 



*The Task Force Chairman, Dr. Grossman, notes: "This is an outstanding ex- 
ample of the combined efforts of a Task Force, working through Councils and 
the APA Reference Committee, supported by officers and trustees, having a 
major plan brought to fruition through the dedicated e^orts of the APA staff." 



402 



Task Force Report 9 

the access of records and to serve as spokesman for the adoption 
of guidelines and policies relating to these matters. 

4. To develop through surveys and special studies methods for im- 
proved handling of health care information that will provide for 
appropriate access and preserve confidentiality. 

5. To accomplish other appropriate objectives not inconsistent with 
those enumerated, by any lawful and ethical means. 

In December 1974, the trustees of the Association voted unani- 
mously to support the National Commission which is now in the 
process of formation under the aegis of an Interim Organizing Com- 
mittee comprising representatives of the APA, American Academy of 
Pediatrics, American Medical Records Association, American Hospi- 
tal Association, Mental Health Law Project, and the National Asso- 
ciation for Mental Health. It is anticipated that the new Commission 
will be incorporated and fully underway before the end of 1975. 



8 



403 



RECOMMENDATIONS REGARDING 
EDUCATION COORDINATION WITH 
OTHER AGENCIES, AND THE NEED FOR 
AN ONGOING GROUP 

Education concerning the problems of privilege and confidentiality 
should be made available in various areas. 

Inservice Education Within the APA Structure. 

It v^ould be helpful if the councils, committees and task forces 
dealing w^ith areas related to privilege and confidentiality were in- 
formed of the findings and progress of this Task Force. Such action 
would add to the coordination of the efforts of the APA in safeguard- 
ing confidentiality of sensitive medical data. 

Inservice Education to All Psychotherapists. 

We would recommend that the APA publish a pamphlet to cover 
such topics as the difference between privilege and confidentiality, 
how to respond to a subpoena, appropriate methods of record keep- 
ing that will preserve confidentiality, and an explanation and a des- 
cription of how to use the new coding system, were it adopted, for 
reporting to the insurance industry. 

Education to the Lay Public. 

Through the lay press, the APA should attempt to clarify 
physician-patient privilege, confidentiality, and the importance of 
these concepts. 

Coordination with Other Agencies. 

Developing insurance forms and coding mechanisms which pro- 
tect confidentiality. Coordination with the Health Insurance Council 
and other groups of the insurance industry will be critical for the 
potential success of the proposed coding scheme. Excellent contacts 
have been established v^th these organizations, but continued effort 
will be necessary so that there can be no question as to the impor- 
tance attached to confidentiality by the psychiatric profession and to 
our concern that confidentiality must also become important to the 

' ■: 9 



404 



Task Force Report 9 

health insurance industry. These efforts could be furthered with in- 
volvement of other medical organizations, including the American 
Medical Association. 

Workshop dealing with data hanks. Our discussions with repre- 
sentatives of various organizations have convinced us that such a 
workshop should involve the American Psychiatric Association in 
effective collaboration with a number of other groups. Through in- 
volvement of groups, including other medical organizations and rep- 
resentatives of the insurance and data processing industries, as well 
as consumer organizations, we would hope to increase the likelihood 
of effective legislative action which would aid patients who seek 
psychiatric help. 

Need for a Specific Ongoing Group within the APA Concerned 
with Confidentiality and Particularly with Confidentiality and 
Third Party Payment. 

The rapidity of developments involving confidentiality and third 
party payment, their complexity, and the needs for continuous active 
involvement for satisfactory resolution, prompt our conviction that 
a specific group within the APA be charged with responsibility for 
issues involving confidentiality. It is our belief that the activity would 
require a long-term group with both "watch dog" and active correc- 
tive force, with the strong backing of the APA. 

In an immediate phase, the active negotiations in which the cur- 
rent Task Force is involved with the insurance industry are still in a 
delicate period with the outcome extremely promising but by no 
means certain. These extensive activities and contacts with the rele- 
vant aspects of the insurance industry must be furthered and con- 
tinued by an ongoing group of the APA, in an atmosphere of mutual 
respect with the insurance industry, but with firm concern on the 
part of the APA group for the needs of the patients, both current 
and potential. 

The current Task Force has accumulated a great deal of infor- 
mation regarding desirable and undesirable practices in relation to 
the insurance industry, and plans over the coming year to convert 
that material to monograph form. Consideration of the evolving 
practices of third party payment and their implications for psychia- 
tric treatment with regard to confidentiality should be an active part 
of the role of an ongoing group. 

Contacts with members of Congress have proved to be extremely 
helpful to the current Task Force and should continue to be so for 
any ongoing action group of the APA. Congress passed and the 
President signed S-3418 into Public Law 93-579 December 31, 1974, 

10 



405 



CONFIDENTIALITY AND THIRD PARTIES 

The Privacy Act of 1974. This protects personal data in Federal 
agencies and creates a seven-member commission to explore similar 
problems in other governmental and private areas. 

We believe that a separate group in the APA should be formed 
concerned with confidentiality, and that the task should not be 
divided among a number of groups which also have other responsi- 
bilities. The area of confidentiality is extremely topical, represents 
one of the most direct ways in which psychiatrists can aid their 
patients in the non-therapeutic situation, and requires the consider- 
able effort that only a vigorous, single-focused group can provide. 



11 



406 



ACKNOWLEDGMENTS OF THE TASK 
FORCE CHAIRMAN 

The Chairman would particularly call attention to the active work of 
Kenneth A. Ritter, M.D., of New Orleans; Jerome S. Beigler, M.D., of 
Chicago; Morton R. Weinstein, M.D., of San Francisco, Jean Craton- 
Neher, M.D., of Palo Alto, California and James M. Trench, M.D., of 
Hartford, Connecticut; among many individuals who worked actively 
in whatever we accomplished on the national scene. 

Special credit should be given to Dr. Richard Johnson for the 
formulation of the Type I-VI Coding, and for the chronology and de- 
tailed reporting of our activities which has made it easier to compile 
this report; and to Frank M. Ochberg of H.E.W. for valuable 
suggestions. 

The help of Central Office from Walter Barton, M.D. and his staff 
in counseling and cheerful cooperation not only made it possible for 
us to function, but added to the pleasure we derived from our task. 
As Chairman, I can only state the obvious, that my co-workers on the 
Task Force were all a dedicated, hard-working group. Their individ- 
ual inputs balanced extremely well in reaching an aggressive, action- 
oriented approach, but still tempered with reason. 



12 



407 



APPENDICES 

Appendix A; General Principles Governing Con/identiarity 

1. Every person has a basic right to the pursuit of health and hap- 
piness, and privacy is a necessary prerequisite for this. 

2. Psychiatric practice cannot properly achieve maximal effective- 
ness except where there is a secure atmosphere of confiden- 
tiality. 

3. We are, together with the patient, chief advocates of an affirma- 
tive atmosphere of confidentiality. 

4. Any authorized release of information to a third party should be 
made only after full discussion with the patient. 

5. Only the minimum information required to meet legitimate needs 
should be released. 

6. We should never collude with the patient in making false repre- 
sentation to a third party. 

7. In rare and special cases where danger to persons, self, or others 
is imminent and can no longer be handled in the context of 
treatment, our obligation to society requires that we break con- 
fidentiality, but only to the minimum extent necessary to protect 
life or property. 

8. The psychiatrist has the responsibility to determine whether 
disclosure of information to family members or other third 
parties will work for or against the patient and his treatment. 

9. The boundaries of disclosure to third parties should be deter- 
mined with the patient in the early stages of treatment. 

10. Blanket consent for release of information is never satisfactory. 
Patients should give specific consent each time for each dis- 
closure to each third party; informed consent should be limited 
to the specific purpose at issue and indicate that it is time limited 
for the purposes of the claim. 

11. Insurance companies and other third parties have a legitimate 
right to certain information about a patient and his treatment. 

12. Information should be released in a way that will promote the 
best interests of the patient and in such a way that it cannot be 
used against his best interest. 

13. Information released to meet a legitimate need of a third party 
should be held in confidence by that third party. Such informa- 
tion must not be re-released to other third parties without the 
specific consent of the patient. 

13 



408 



Task Force Report 9 

14. No person should be penalized by his insurance company be- 
cause of receiving treatment. 

15. Insurance cost accounting should always be made in aggregate 
without reference to confidential information concerning in- 
dividuals. 

16. Eligibility to obtain insurance or employment should be deter- 
mined by examination for that purpose, not by reference to in- 
formation from treatment. 

17. National Health Insurance laws must have specifically detailed 
outlined legislative safeguards for the protection, gathering, 
storage, retrieval and distribution of data about patients, and 
not be cloaked in general terms. 

18. Schools and employers should get information about treatment 
only when such release is in the interest of the patient and must 
take into account that the patient's condition is subject to im- 
provement. School and work records reflecting treatment must 
therefore not brand the patient unfairly with no longer current 
information. Furthermore, such records should be destroyed 
after an appropriate short interval. 

19. We should apply these same general principles to the problem 
of privilege, which is a separate and distinct sub-category of 
confidentiality. 

20. We should work for the strengthening of laws and procedures to 
protect privilege, confidentiality, and the privacy of our patients 
and to secure the support of the public including our patients in 
this effort. 

Appendix B: Proposed Coding for Mental Disorders 

The realities of current and future health insurance coverage for 
psychiatric treatment will include the need to report some justifica- 
tion for the treatment, whether for hospital costs or physicians' 
services. In the past, using official diagnoses often led to the demand 
for completing detailed questionnaires plus repeated experiences of 
breach of confidentiality that were destructive both to the patient 
and the treatment process. Efforts have been made to demonstrate to 
the insurance industry that other forms of reporting might better 
serve the needs of our patients while meeting the needs of the indus- 
try more effectively. 

The Coding System which is listed below has been formulated to 
divide reportable conditions, not due to physical or organic factors, 
into six general categories. These categories represent a synthesis 
of diagnosis with varying degrees of impaired function. It is for that 
reason that some diagnostic categories appear in more than one of 

14 



409 



CONFTOENTIALITY AND THIRD PARTIES 

the six designations. The category type may possibly be changed in 
later evaluations as the clinical function of the patient changes. 

Insurance reports would merely signify "Category I (or II, III, IV, 
V, or VI)" instead of DSM II diagnosis and code nmnber which 
should be kept in the doctor's confidential file. This private evalua- 
tion would be available only imder proper safeguards to peer review 
colleagues or to the Medical Director of the carrier. Such reports 
would go directly to the Medical Director and not through ordinary 
channels and would be protected by the medical ethics of the Medical 
Director. 

We recognize that the insurance industry needs certain data for 
actuarial purposes. However, the extensiveness of treatment required 
and choice of treatment approaches can not be indicated by diagnosis 
alone. It is suggested that in reporting, the nature of proposed treat- 
ment be made available to medical representatives of the insurance 
carrier and any question about the appropriateness of the intensity 
or duration of treatment be referred to peer review procss. 

A criticism from the insurance industry is that conditions in 
Category I would indicate no need for compensible treatment. This 
overlooks the factors of anxiety and/or depression liberated by such 
conditions. At the minimum it would require a diagnostic interview. 

In general, the code tries to convey the general nature and seri- 
ousness of the condition at the presenting time of the report. While 
prognosis might be inferred, it cannot be specifically determined 
from the code number used. It is assmned that inquiries from the 
insurance carrier will be made by their Medical Director for a speci- 
fied, concrete purpose. It is expected that this would not be a fre- 
quent occurrence, and under no circmnstances be made available to 
any other party, nor even to the patient. 

Proposed Coding For Mental Disorders 

A. Mental Retardation. 

B. Mental Disorder associated with physical or organic factors. 
(Would suggest the nature of the physical or organic factor be 
reported in general terms, e.g., endocrine, infectious, circulatory, 
tumor, etc.) 

C. Mental Disorder currently considered of psychogenic origin. 

1. Acute Situational (basically healthy personality reacting ab- 
normally to stress situation.) 

2. CharacterioIogicaJ or Emotional with fair adaptation in most 
areas (e.g., mild neuroses or character disorders, etc.) 

3. Characteriolo^cal or Emotional with less adequate adapta- 

15 



410 ', 



Task Force Report 9 

tion in some areas (e.g., oral type character disorders or neu- 
roses, etc.) 

4. Characteriological or Emotional with poor adaptation in some 
or involving many areas [e.g., infantile type neuroses or char- 
acter disorders, and some forms of psychotic reactions, etc.] 

5. Severe Emotional Disorder v^ith poor or no adaptation in one 
or more crucial areas of functioning (e.g., extremely severe 
neurotic or psychotic syndromes.] 

6. Most Severe Emotional Disorder with poor or no adaptation 
in enough areas to require constant supervision and not re- 
sponding to continued, active psychiatric treatment (e.g., 
totally withdrawn psychotics, totally incapacitated conver- 
sion hysterics, some character disorders, etc.] 

It is recognized that most patients cannot clearly fit a text book 
picture. The category selected will depend on the judgement of the 
psychiatrist considering all factors that pertain to any specific pa- 
tient. The above examples are just that and are not intended for de- 
termining any one specific case designation. Similarly, the compari- 
son below of the Type Codes to the DSM II Manual of Diagnoses is 
to be considered in like manner. 

DSM II Breakdown for the Above Codes 
Category I Acute Situational 

Transient Situational Disturbances 

307.0 — 307.4 Adjustment reaction of infancy, childhood, 
adolescence, adult and later life 

Social Maladjustment without manifest psychiatric disorder 

316.0 Marital maladjustment 

316.1 Social maladjustment 

316.2 Occupational maladjustment 

316.3 Dyssocial behavior 

316.9 Other social maladjustment 

Category II Characteriological or Emotional Problem with fair 
adaptation, but with interfering symptoms requiring 
treatment 

Neuroses 

300.0 Anxiety 

300.1 Hysterical 

300.4 Depressive (reactive) 

16 



411 



CONFIDENTIALITY AND THIRD PARTIES 

Personality Disorders 

301.5 Hysterical 

301.4 Obsessive Compulsive (less severe symptoms) 

NOTE: A good example where treatment can be 
difficult and long. 

Behavior Disorders of Childhood and Adolescence (any of the 
less severe behavior problems in an otherwise apparently healthy 
young person] 

308.0 Hyperkinetic reaction 

308.1 Withdrawing reaction 

308.2 Overanxious reaction 

308.3 Runaway reaction 

308.4 Unsocialized aggressive reaction 

308.5 Group delinquent reaction 
308.9 Other reaction 

Category III Characteriological or Emotional Problems with less 
adequate adaptation in some areas 

Neuroses 

300.13 Hysterical, conversion type 

300.2 Phobic 

300.3 Obsessive compulsive (with more disabling 
symptoms) 

300.4 Depressive (with more interference with 
functioning) 

300.5 Neurasthenic 
300.7 Hypochondriacal 

Personality Disorders 

301.1 Cyclothymic (moderate) 

301.2 Schizoid 

301.3 Explosive 

301.4 Obsessive compulsive (more severe) 

301.6 Asthenic (moderate) 

301.81 Passive aggressive 

301.82 Inadequate 

Sexual Deviation 

302 Series as listed (less severe problem with 

basically good ego strength) 

17 



«;fi_/i7i n 



412 



Task Force Report 9 

Alcoholism 

303.0 Episodic excessive drinking (addiction not clearly 

established] 

Drug Dependence 

304 Series as listed (less severe and with good ego 
strength) 

Psychophysiologic Disorders 

305 Series as listed (less severe with basically good 
ego strength) 

Special Symptoms 

306 Series as listed (less severe speech disturbances, 
tics, etc. with basically good ego strength) 

Behavior Disorders of Childhood and Adolescence 

308 Series as listed (more severe and in more troubled 

personality) 

Category IV Characteriological or Emotional with poor adaptation 
in some or involving many areas 

Psychoses 

295 Schizophrenia series as listed, with some social 
functioning 

296 Major affective disorders series as listed, with 
some social functioning 

Neuroses 

300.14 Hysterical, dissociative type 

300.4 Depressive (severe but not psychotic) 

300.5 Neurasthenic (severe and chronic) 

300.6 Depersonalization , 

Personality Disorder 

301.0 Paranoid 

301.3 Explosive (severe with poor control) 

301.7 Anti-social (severe) 

301.82 Inadequate or infantile (marked) 

Sexual Deviation 

302 Series as listed (more severe problem with poor 

ego strength) 

18 



413 



CONFIDENTIALITY AND THIRD PARTIES 

Alcoholism 

303.1 Habitual excessive drinking 

303.2 Alcohol addiction 

Drug Dependence 

304 Series as listed [if chronic, severe, and in a 

troubled personality) 

Special Symptoms 

306 Series as listed (if chronic, severe, and 

incapacitating; e.g., anorexia nervosa) 

Psychotic Reaction 

Short-term break with reality in otherwise fairly 
well integrated personality 

Category V Severe Emotional Disorder 

Neuroses 

300 Series as listed, unable to function in a crucial 

area, but showing change in treatment 

Schizophrenia 

295 Series as listed, unable to function in one or 
more crucial areas, but showing response to 
treatment, and with history and onset suggesting 
some favorable possibilities 

Major Affective Disorders 

296 Series as listed (with some qualifications as 
under 295 in this category) 

Category VI Most Severe Emotional Disorder 

Any chronic neurotic, characteriologic, or psychotic disorder so 
poorly adapted that constant supervision is necessary, and having 
shown no response to previous active, continued treatment, but will 
require symptomatic treatment or constant supervision. 

Examples of coding as noted above, many factors may be determined 
by the reporting psychiatrist that cannot be foreseen in such a gen- 
eralized plan. He will obviously use his judgement as to how a specific 
patient fits the general intent of the Code system. The use of DSM II 
is dictated by it being the one officially adopted by the APA, and does 
not represent any judgement on its general acceptability. Again, it is 
being used to give some suggestions how the Code system might be 

19 



414 



Task Force Report 9 

applied. It might be well to repeat that, whatever basis for using a 
Code number for any specific patient is used, it should be recorded 
in the psychiatrist's own records, since some form of peer review will 
probably be instituted. Some examples follow: 

1. A brief emotional crisis period might be resolved in one interview, 
or the severity of the symptoms might require a brief period of 
intervention for the patient to cope with the crisis and regain his 
equilibrium. It might be diagnosed "307.3 — Adjustment reaction 
of adult life." It could then be coded "I". If the same crisis really 
provoked an underlying neurosis, but with good reintegration, it 
could be coded "11." 

2. A mild reactive depression which in DSM II is coded 300.4, De- 
pressive Neurosis, could use code"II." 

3. A patient whose depression was more severe, but not psychotic, 
could have the same DSM II diagnosis, but be coded "HI." 

4. Making a diagnosis of 301.81, Passive-Aggressive Personality Dis- 
order, with enough interference in functioning could be coded 
"III" 

5. A patient diagnosed Schizophrenic could be coded "IV," "V," or 
"VI," depending on the severity and interference of the symptoms, 
the nature of the onset, the response to treatment, or the chroni- 
city and failure of responding to treatment; so could a "paralytic" 
conversion hysteric who had been neglected. 

If, in special instances, the hazard to the patient of disclosure is 
exceptional, this should be made known to the Medical Director of 
the insurance carrier and the necessary information made known 
directly to him. 

Appendix C: Position Statement on the Need for 
Preserving Confidentiality of Medical Records in Any 
National Health Care System 

This statement was approved by the Board of Trustees of the Ameri- 
can Psychiatric Association on October 1, 1971, upon recommenda- 
tion of the Task Force on Confidentiality as It Relates to Third 
Parties.* 

Many approaches to establishing a national health care system 
are now being considered. Whatever system may eventually be 
adopted will inevitably entail the collection of intimate and private 



*The task force included Maurice Grossman, M.D., chairman; Jack D. Barchas, 
M.D.; Richard G. Johnson, M.D. and Joseph Satten, M.D. 

20 



415 



CONFIDENTIALITY AND THIRD PARTIES 

medical, psychological, and social data concerning those who use it. 
How these data are utilized can have a tremendous impact on the 
privacy and lives of identifiable individuals and, collectively, on the 
entire body politic. Protecting the confidentiality of medical dis- 
closures is especially imperative for those who need and obtain 
psychiatric treatment, as has already been recognized, e.g., by the 
laws of many states, in court decisions, and in the drafting of the 
code of evidence for the federal judiciary. 

Two separate bodies of data will be collected. 

The first will include identification of the individual in the pro- 
cess of establishing eligibility for treatment and in reporting the treat- 
ment process. In our view the confidentiality of these data can be 
safeguarded by limiting the information disclosed to the least amount 
necessary for establishing eligibility and by developing methods to 
control overusage of the system. Review of such identifiable data, if 
it is necessary at all, should be minimal, and the availability of the 
data should be confined to carefully selected personnel at the treat- 
ment site. Under no circumstances should the data be duplicated and 
recorded elsewhere or rendered available to groups that are not con- 
nected with the treatment situation. The data should be used only to 
facilitate the treatment process. 

The second group of data will be needed for program review, 
for the evaluation of the efficacy and efficiency of the system, and 
for medical and administrative research. These data will be com- 
puterized. 

In the case of program review and evaluation, it will be vital to 
protect the identity of the patient with reference to the data that are 
collected and stored. (There can be no objection to identifying pro- 
viders, individual or group, for whatever review is needed.) 

However, medical research will entail the collection of much 
intimate data on the individual; this will require careful planning 
concerning how the material is to be stored and who will control 
accessibility to the data and for what purposes. Specific legislation 
governing these matters must be carefully framed if the confiden- 
tiality of the records of the individual patient is to be fully protected. 

The framers of national health care proposals should be fully 
cognizant of the imperative need for safeguarding the confidentiality 
of medical records in the contexts described here. 

Appendix D. Position Statement on 

The Role Of Confidentiality In Volunteer Military 

Drug Abuse Treatment Programs 

The American Psychiatric Association was much encouraged and 

21 



416 



Task Force Report 9 

pleased when the President and the Department of Defense adopted 
a policy of viewing the drug abuser as a medical problem, while still 
maintaining its efforts to eradicate the traffic in drugs. A treatment 
program written by the military establishment must be seen as posi- 
tive action directed toward furthering the primary mission of the 
armed forces. 

The role of confidentiality in successful psychiatric treatment 
has been well established. The development of a positive treatment 
atmosphere for a voluntary rehabilitation program for drug abusers 
is partially contingent upon the degree to which a psychiatrist can 
assure the patient of the confidentiality of his disclosures. The real 
or threatened adverse consequences of disclosure may cause per- 
sonnel to avoid seeking treatment altogether or not to cooperate fully 
in the treatment regime. 

As civilian psychiatrists, we can only recommend those things 
concerning confidentiality which we feel will help lead to an effec- 
tive voluntary military drug abuse treatment program. In any pro- 
gram offering confidentiality, the limits of confidentiality must be 
defined. Any promise of nonpunitive action must truly be nonpuni- 
tive; otherwise, subsequent disillusionment of the treated person will 
create destructive reaction to both his treatment and the program in 
general. There have been examples of previous unsuccessful treat- 
ment programs where the limits of confidentiality were not well de- 
fined and, indeed, did not prevent secondary punitive action from 
taking place. This protection for those honestly seeking help will 
provide a more effective program and increase motivation for help. 

The act of volunteering should only grant protection for a con- 
fidential evaluation prior to acceptance into the drug abuse treatment 
program, and for ongoing participation and cooperation in the pro- 
gram. In recommending this amnesty, we do not imply that person- 
nel in treatment are immune from consequences of unacceptable be- 
havior secondary to or not related to the fact of treatment. 

Being labeled a drug abuser is punitive in itself. For that reason, 
as far as possible, all medical records of treatment should be held 
inviolate in the medical treatment sector. In military programs, as in 
civilian programs, both the patient and psychiatrist recognize that, at 
times, for various reasons, this confidentiality cannot be absolute. 
The medical unit and command unit must be aware of each other's 
needs and responsibilities, and adequately keep each other informed 
of factors that would represent a hazard to the treatment of the in- 
dividual or to the command's mission. (Army regulation AR-40-42 is 
an existing example of these safeguards.) 

There are three special considerations brought to our attention 
that could also seriously and adversely affect the viability of drug 

22 



417 



CONFIDENTIALITY AND THIRD PARTIES 

abuse treatment programs: 

First, compromising conditions for entering the treatment pro- 
gram should be avoided. For example, making amnesty or treatment 
conditional on the individual becoming an informer will seriously 
affect the credibility of the program. (The Army has taken note of 
this in Army regulation AR-40-42, paragraph 6G, which specifically 
deals v^th this point.) 

Secondly, there have been reports of damaging breaches of the 
patient's confidentiality by critical information being released to 
civilian sources after discharge from military duty. One way of ex- 
posing individuals in drug treatment programs after separation from 
service has been the SPN number on discharge papers. We would 
urge re-examination of the policy of using these SPN numbers on 
discharge records that are not kept in confidential military medical 
files. 

The third consideration is the intermingling of general personnel 
records and medical records at the National Personnel Record Center 
after separation from service. These medical records have been made 
available for other than military uses after personnel have returned 
to civilian life. For protection of confidential information, we would 
recommend an exploration of methods to separate from personnel 
records the medical records and references to medical diagnoses. 

We are pleased that the Department of Defense is already con- 
sidering the problem of confidentiality and we hope these comments 
will be of use in the implementation of its programs. 

Proposed by the APA Task Force on Confidentiality 
as Related to Third Parties 

Maurice Grossman, M.D. 
Richard G. Johnson, M.D. 
Joseph Satten, M.D. 
Jack D. Barchas, M.D. 
Alan L. Krueger, M.D. 

Appendix E: Recommendations Of The Task Force On Confidentiality 
As It Relates To Third Parties To The Council On Professions And 
Associations, October 1971 

1. That APA adopt a position recommending its members limit in- 
formation to insurance companies for health care reimbursement 
to the following: 

a. Recognition that an unspecified psychiatric condition does 
exist (in place of diagnosis). 

23 



418 



Task Force Report 9 

b. Approximate date that patient recognized symptoms and 
need for treatment (or onset). 

c. Nature of treatment in general terms. 

d. Billing which shows frequency and cost of treatment. 

e. Billing which shows whether office, home, or hospital treat- 
ment — to justify fees. 

If any of the above proves discriminatory in special situations 
and information is withheld, peer review should be offered. (The 
IBM system demonstrates it can work.) 

2. That APA adopt a position recommending its members refuse to 
channel any sensitive reports through employer agencies; and 
that reports to medical directors of insurance companies be 
noted, "any divulgence to other party or for other purposes will 
constitute a breach of the release waiver and of medical ethics." 

3. That APA adopt a position that the reports for life insurance ap- 
plications be obtained from examinations for that purpose and 
not from psychotherapists. 

4. That APA adopt a position approving forms only if waiver to 
release information is limited for specific agent, specific purpose 
and time, (in place of current blanket release) with notation 
given in #2. 

5. That APA pursue these proposals with the AMA to get their 
support for similar position. 

6. That APA encourage Congress to write in safeguards for con- 
fidentiality as an integral part of the plan in whatever bill for 
national health care finally evolves. 

a. Some forms of coverage automatically obviate any need of 
information to support treatment availability. 

b. Confidentiality of research data will depend on the mechan- 
ism and persons controlling the information "machinery." 

c. "There is need to demonstrate and explain graphically the 
difference between its general medical model of treatment 
and the current model of psychiatric care in our present day 
status of the art." (Minutes of July 10-11 meeting). 

7. That APA issue a statement supporting Senator Hughes' posi- 
tion on the impact of lack of confidentiality on the drug abuse 
program of the military (and eventually of the general civilian 
program). 

24 



419 



CONFIDENTIALITY AND THIRD PARTIES 

8. That APA commend the Commission of the Federal Judiciary for 
retaining Code 504 — Psychotherapist-Patient Privilege — BUT — 

a. Request them to strengthen it by adding to definition of 
psychotherapist, "or any licensed physician treating an ill- 
ness with emotional components as cause." 

b. Request them to consider statement of psychiatrists' needs 
for protecting patients while defenses are down during ther- 
apy, to include version of Illinois law that extends the priv- 
ilege to the psychotherapist as well; and that law's liberaliza- 
tion by deleting exceptions to the privilege. 

9. That APA consider the suggestions from Louisiana, and notify 
its District Branches that the proposed Federal Code will be 
acted on in November; and that they enlist support of their con- 
gessmen to enact the above changes. 

10. That APA consider, in any section of its code of ethics on main- 
taining confidentiality, NOT to include any exception, such as in 
AMA Section 9, "unless required by law," since being law abid- 
ing is a major ethic in itself. Further, that the APA discuss with 
the AMA the deletion of this phrase from Section 9, for reasons 
already given. 

11. That APA undertake a sampling survey of its members to deter- 
mine their attitudes on confidentiality and incidence of impair- 
ment in patients' welfare occasioned by released information or 
threat of such release. 

12. That APA subsidize a sampling survey of the general public 
about their beliefs, how protected they are from physician dis- 
closures, and whether it would affect them in any way. 

13. That APA bring this problem to the attention of training centers, 
with the following goals in mind: 

a. To emphasize to medical students and psychiatric residents 
their responsibility for confidentiality. 

b. To teach them that record keeping must vary with purpose 
in mind, and awareness of ultimate fate of the records. 

14. That APA elaborate its previously issued discussion of response 
to subpoenas, and issue it as a brochure with a description of the 
subpoena-issuance process and its implications, with specific 
steps to be taken at specific times. 

15. That APA consider the need for "consumer" demand for such 
protection and explore ways of publicizing the problems. The 
current growing general unease about invasion of privacy of 
information could facilitate this. 

25 



420 



Task Force Report 9 

16. That the APA trustees secure legal counsel's opinion for the 
Task Force about: 

a. Patient's blanket authority for release of information, espe- 
cially in light of doctrine of enlightened consent, and sub- 
stitution of limited consent form. 

b. Some members' use of form to be signed by patients waiving 
their right to permit release of, or demand for, records. 

c. Some members keeping no records, as way of defeating any 
demand for records. 

17. That the trustees emphasize to all councils, committees, and task 
forces that some of their actions and recommendations might 
adversely affect the climate of confidentiality, and their recom- 
mendations should include safeguards to protect it. 

a. Much of our discussion relates to the province of the Com- 
mittee on Psychiatry and the Law, and our minutes have 
been made available to them. 

b. Much of our discussion relates to the province of the Com- 
mittee on Financing of Mental Health Care, and our manutes 
have been made available to them. 

c. Reference has been made to problems that might concern 
Committee on Children and Adolescents. It is recommended 
that relevant sections of our minutes, especially of the July 
10-11, 1971 meeting be brought to their attention. 

d. The question of research records and confidentiality has been 
explored by another Task Force. Our Task Force is uncertain 
that reHance can be placed in ordinary governmental safe- 
guarding of privacy. 

e. The impact of lack of confidentiality on treatment programs 
should be considered by the Committees on Alcohol and 
Drug Abuse. 

18. And, most importantly, that the APA seek funding for a project 
to explore systems of safeguarding data, while accumulating the 
valuable detailed information that will be available in a national 
health care program. Further, the APA should seek ways of 
using this data to better understand psychiatric illness, its na- 
ture, its sources, its response to treatment. One limited goal 
would be to seek a system of classification that would be mean- 
ingful for etiology, prognosis, and treatment. The recognition 
that this will require intimate individual identifiable data makes 
more pressing the consideration of safeguarding this data in the 
initial planning stages. 

26 



421 



CONFIDENTIALITY AND THIRD PARTIES 



Appendix F; Principles Governing Con/identiaiity And 
Disclosures To Third Parties [September, 1973] 

1. TheNeed 

There is a consensus in the psychiatric world, the legal commu- 
nity, and a general philosophy that psychiatric treatment requires a 
positive atmosphere of confidentiality to protect the patient's right to 
the pursuit of health and happiness (GENERAL PRINCIPLE I]; and, 
even more important, to create that positive atmosphere of confiden- 
tiality that will encourage individuals needing help to seek that help 
without fear of destructive disclosure to the rest of the world. Less 
widely stated, but still recognized, is the fact that hazard to patients 
still exists in our social climate from disclosure of having been in 
treatment. Some diagnostic terms have discriminating social connota- 
tions and can cause injury to patients if made known to others. Al- 
though it is generally recognized that each patient is responsible for 
protecting his own rights, nevertheless, our relationship as therapists 
to those patients places us in the position of being their chief advo- 
cates for protecting their rights to confidentiality [GENERAL PRIN- 
CIPLE II). This need to be their advocate is increased when patients' 
ability to protect themselves is impaired by their psychological state 
or functioning; in states of temporary regression that may be incident 
to the therapeutic process; where patients give consent under duress; 
or where patients give consent, uninformed of the consequenses of 
their consent. 

It would be ideal if we could have that social state where all pa- 
tients could freely, but safely, speak of their psychiatric illness and 
treatment. For them to be able to openly accept this would truly 
facilitate seeking and cooperating in treatment. Realistically we have 
not achieved that social state even though improvements have taken 
place. Attitudes of a large part of our social world are still prejudicial 
and the livelihood and social well-being of some of our patients can 
be threatened in reality by the disclosures mentioned above, apart 
from any neurotic fear of discovery. It is in recognition of the reality 
of this social state that this report has been formulated. 

2. The Problem 

Problems are created, however, when third parties have both a 
legitimate and an ethical right to some information about the patient, 
the treatment process, or even disclosures during the treatment proc- 
ess. We must differentiate between our obligations to the patients in 
protecting their privacy and the disclosures they have made to us for 
the purpose of treatment; and the need to recognize that information 
which legitimately should be disclosed to a third party, often with 

27 



422 



Task Force Report 9 

the patient's consent, for advantages that are important to the pa- 
tient or conversely by reason of obligation to society that supersedes 
the patient's rights. 

It would be just as destructive to the treatment process if we 
knowingly became a party to any manipulation of fact (as differ- 
entiated from withholding information because of confidentiality 
needs) (GENERAL PRINCIPLE III). For many reasons, it would be a 
breach of professional ethics; even more, it would be just as destruc- 
tive to the psychotherapist-patient relationship in preserving the at- 
mosphere of integrity necessary for effective psychotherapy. In 
general, whenever there is the problem of information to be released 
to any third party, it should be discussed with the patient before- 
hand, unless unusual circumstances make this impossible (GENERAL 
PRINCIPLE IV). 

There are situations where a physician's obligation to consider 
hazards to society outweigh his obligation to preserve the privacy of 
the patient, even without his consent. These are usually when the 
patient and his behavior represent a clear and extreme danger to 
himself or others. Usually such crises are most frequently technical 
treatment problems. If possible, they should be worked out through 
treatment techniques. Also, outside consultation should be care- 
fully considered. Once such resources have been sought and in the 
psychiatrist's judgment the patient represents an extreme danger to 
himself or others that cannot be contained therapeutically, it is 
necessary to notify others of the hazard for the protection of the 
patient or these others, and confidentiality should be broken to the 
extent necessary (GENERAL PRINCIPLE V). 

3. Special Situations 

There are special considerations that must be weighed in certain 
circumstances. Because of the growing involvement of third parties, 
absolute privacy in all situations is now a thing of the past, if it really 
existed beforehand. The problem is to minimize the effect of dis- 
closure, on the treatment process, as it affects the patient, and as it 
affects other parties concerned with this privileged information. 
When information is to be divulged, it should be that minimum 
necessary. 

4. Family (And School) Requests 

The most common special situation is the request for informa- 
tion from family members. In many situations, discussing some of 
this information may actually help the therapy and directly and in- 
directly help the patient. It therefore imposes a burden on the thera^ 
pist to decide whether disclosure operates for the patient or against 

28 



423 



CONFIDENTIALITY AND THIRD PARTIES 

the patient (FAMILY PRINCIPLE I). This same applies to informa- 
tion disclosed to school teachers and others in the school system dur- 
ing the treatment of children. In this latter situation the problem is 
complicated by the school personnel making written records of this 
information that eventually becomes out of date or is misused by 
others not having the opportunity of first-hand consultation with the 
therapist. Where the family is involved, there should be prior agree- 
ment among the patient, the family, and the therapist on the stand- 
ards of confidentiality that will be applied (FAMILY PRINCIPLE II). 
Even when total withholding of information is practiced, the involve- 
ment of the family should not be ignored, and they should be helped 
with whatever support they might need in the situation. This is based 
on the reality that the emotional state of the family is going tohave a 
direct effect on the patient and be a subsequent influence on therapy 
of that identified patient. 

5. Insurance Reports 

Requests for information from insurance companies and/or em- 
ployers who subsidize insurance programs for treatment cost reim- 
bursement have become the most frequent imposition on confiden- 
tiality, with proportionately grave interference with patients* wel- 
fare. Inasmuch as insurance coverage constitutes a contract limiting 
to some extent the benefits to which the patient is entitled, there 
exists a legal and ethical need to give others information to deter- 
mine whether the treatment costs are within the boundaries of the 
contract. Foremost, any patient receiving care through any system of 
paying for such care should have access to all medical services with- 
out jeopardizing their privacy or their confidential relationship with 
their physician (INSURANCE PRINCIPLE I). This latter condition is 
a necessary component of effective treatment. Therefore, no system 
should jeopardize such effectiveness. Secondly, since the purpose of 
insurance is to minimize the risk and impact of calamities by spread- 
ing the risk, no patient striken by illness in any form should be 
penalized because he has added "a burden" to the group load (IN- 
SURANCE PRINCIPLE II). The patient as an individual should have 
confidentiality protected by considering group experience in all cost 
accounting proceedings for whatever purpose.* 



*Over 90% of health insurance coverage is through industrial group policies 
where all members of the group are blanketed in regardless of their state of 
health, other than excluding conditions whose onset antedated application of 
the contract. Some life insurance written on a group basis operates the same 
way with additional proviso that an examination is required for those over a 
specified age. Premiimis are set to cover the statistical chance of poor, aver- 
age, and excellent probabilities of morbidity or mortality. Even when added 

29 



424 



Task Force Report 9 

Because of the reasons given above, treating psychiatrists will 
have to give some information if their patients are to have the benefit 
of insurance coverage [INSURANCE PRINCIPLE III). This informa- 
tion would include that a psychiatric condition, unspecified, does 
exist to indicate that there is a medical condition covered by the 
contract. In some situations, only to demonstrate that the illness did 
not exist prior to a contract where the contract excludes such illness, 
it will be necessary to give approximate date of onset of the symp- 
toms complained of by the patient. To substantiate the type and 
frequency of treatment given, it may be necessary to give some in- 
formation indicating the general degree of unspecified impairment. 
Peer review would be preferable. The general nature and frequency 
of treatment might have to be recorded for billing purposes. 

No information given in a written report for these purposes 
should be in language that could be construed in any way, by anyone, 
to defame the patient. If necessary, such information should go di- 
rectly to a physician representative of the third party, preferably in 
verbal communication, with statements that such information is being 
divulged under ethical professional obligation of the recipient as well 
to maintain confidentiality. This has been acceptable to a number of 
insurance companies, but subject to peer review on demand. Under 
no circumstances should any sensitive information from treating 
physicians, required for insurance purposes as given above about an 
identified individual, be routed through or be made available to an 
employer (INSURANCE PRINCIPLE IV).* Reporting to the employer 
for cost accounting purposes should be done on a group basis, without 
any identification of any patient creating any load on the system. 
Once this information has served the legitimate purposes given 
above, after medical evaluation of its appHcation to the insurance 
contract, no further use should be made of this information in iden- 
tifiable, individual recording or data storing. Since this will be even 
more complicated with the advent of national health care coverage, 

premiums are demanded for known pathology risks, the same evening out by 
distribution operates. To then eliminate those who are unfortunate enough to 
develop costly medical problems overlooks the fact that some under the same 
contract may never develop illness requiring payment for treatment. 

•There are situations where an employer must be notified of circumstances 
developed in the treatment relationship to secure cooperation in therapy; or 
because the danger to society is greater than the obligation to the patient (see 
GENERAL PRINCIPLE V above). If this be so, the disclosure should be based 
on the general treatment situation and not incidental to insurance reporting. 
While some contracts demand processing of claim by employer, most carriers 
will accept report going directly to medical department of the insurance com- 
pany. INSURANCE PRINCIPLE IV about employer access has been accepted 
by the AMA and the International Claim Association. 

30 



425 



CONFIDENTIALITY AND THIRD PARTIES 

and because there will be a storage of much individual intimate ma- 
terial, a separate policy statement on this has already been formu- 
lated. The essence of this statement is that we must separate mini- 
malized data needed to assure individuals' rights to care from the 
data needed for any statistical purpose of administration or research 
(NATIONAL HEALTH PLANS PRINCIPLE I). That data to be re- 
corded for all purposes, the protection of the data once recorded, and 
the limitations of its accessibility should be an immediate and integral 
part of any initial plan for national health care coverage (NATIONAL 
HEALTH PLANS PRINCIPLE II). 

6. The Courts and Subpoenaed Information 

The first section of this position paper is especially applicable 
in court. The demand for information about our patients by courts or 
other governmental bodies via the power of subpoena presents spe- 
cial problems. Such demands are not as frequent as others, but when 
they occur, they can have a devastating effect on the patient and his 
psychotherapy. Recent developments have been more favorable to 
the protection of this information. This protection has been increased 
by judicial decision recognizing the importance of preserving this 
confidentiality, as exemplified by the California Supreme Court deci- 
sion limiting disclosure to the bare minimum where exceptions to 
psychotherapist-patient privilege are written into the law. In that de- 
cision, they were quite explicit in stating that any further protection 
must come from legislative action, even though they recognized the 
seriousness of the existing threat. 

The California Legislature, as did some other states, created the 
bulk of such protection in law in creating the act that provides 
psychotherapist-patient privilege. The exception that waived the pro- 
tection for the patient litigant has been a destructive loophole as 
witnessed in actual court proceedings. The Federal court system was 
about to deny any protection, but finally in their proposed Code of 
Evidence incorporated a code similar to that in California.* Congress 
failed to accept this proposal. Illinois, which had a similar law, al- 
most eliminated this exception entirely; but did modify it to im- 
prove the protection in divorce and child custody proceedings. This 
was accomplished through active efforts of the Illinois District 



•Proposed Federal Rule 504 creating psychotherapist-patient privilege has three 
broad exceptions to this privilege. That labeled (c) reads: "Condition an ele- 
ment of claim or defense. There is no privilege under this rule as to communica- 
tions relevant to an issue of the mental or emotional condition of the patient in 
any proceeding in which he relies upon the condition as an element of his claim 
or defense, or after the patient's death, in any proceeding in which any party 
relies upon the condition as an element of his claim or defense." 

31 



426 



Task Force Report 9 

Branch. The section protecting confidentiality in the act creating the 
Office of Drug Abuse Control specifies very clearly the conditions 
that a judge must consider before ordering the disclosure of confiden- 
tial information. This resulted through effort via the APA. 

To fully protect the confidentiality of our patients' communica- 
tions, we must clearly separate the concepts of "privilege" and "con- 
fidentiality." The former term is purely legal indicating a right granted 
by law not to give information in a legal proceeding to influence the 
eventual outcome. It can be claimed only by designated parties and 
can be lost via various acts on the part of the owners of the privilege. 
In addition, information can be forced to be disclosed, and can be 
removed later by judicial determination that it should not have been 
disclosed, thereby preserving the legal purpose of privilege. This is 
one example where privilege is preserved but confidentiality is lost. 
The only safeguard to confidentiality is to legally protect the infor- 
mation from any disclosure. 

It is in this area that the subpoena process often skirts the legal 
protection of the patients' privacy and the confidentiality of the in- 
formation disclosed in therapy or fact of being treated or of diagno- 
sis having been made. This requires that the psychiatrist, while hon- 
oring the subpoena, not divulge any information without the consent 
of the patient (COURT DEMAND PRINCIPLE I), or until the demand 
via subpoena has been legally evaluated and properly challenged, 
according to the laws of the jurisdiction in which a subpoena has 
been issued (COURT DEMAND PRINCIPLE II]. In California and 
some other states, he has a legal obligation to challenge this demand. 
In other jurisdictions, including some Federal ones, where this legal 
obligation may not exist, he has an ethical obligation to do so and 
not release this information until all resources have been explored. 

The gharacteristic deficiency and threat to confidentiality are 
inherent in the exceptions to privilege via the patient-litigant auto- 
matic waiver of the privilege protection, no matter how well pro- 
tected by the limitations pronounced by the California Supreme 
Court as evident in actual proceedings that have followed that deci- 
sion. It exists still in CaHfornia law and in the current status of the 
proposed Federal Code, and certainly exists in the courtroom itself 
where these laws are interpreted. This requires that efforts be made to 
influence legislatures and Congress to limit the exceptions to psycho- 
therapist-patient privilege based on experiences in the courtroom of 
the various states. If the langauge of the patient litigant exception can- 
not be removed entirely, it would be well to substitute the language 
of Section 408, PubHc Law 92-255: "In assessing good cause, the 
court shall weigh the pubHc interest and the need for disclosure 
against the injury to the patient, to the physician-patient relation- 

32 



427 



CONFIDENTIALITY AND THIRD PARTIES 

ship, and (to the treatment services)" substituting for the last phrase 
"society's right to protect treatment." Until then, the issue needs to 
be challenged in the courts until precedent for adequate protection 
evolves. (See Appendix G.) 

7. Employers 

In certain occupations where the emotional health is vital to 
carrying out grave responsibilities, there is an obligation on the ther- 
apist to determine when and where breaches of confidentiality must 
be considered. It is our opinion that the judgment of danger should 
rest primarily on the observable job behavior and not on the mere 
fact that an employee is or has been in treatment. It is to the employ- 
er's benefit to encourage employees to seek early help for emotional 
problems. Any hazard to continued employment merely by disclo- 
sure of being in treatment will discourage such employees from seek- 
ing the help that they need to carry out those grave responsibilities 
safely. The appHcability of GENERAL PRINCIPLE V on breaking 
confidentiality could apply if all the conditions are met and a clear 
hazard to others cannot be handled therapeutically. 

In summation, the decision of whether or not to release informa- 
tion, while governed by the principles following, should be decided 
upon each individual patient and on each individual situation at the 
time the need for the release of this information is being considered. 

Principles Governing Protecting Confidentiality 
in Disclosures to Third Parties 

General Principle 1. Concensus is that psychotherapy requires a 
position atmosphere of confidentiality to protect patients' rights 
to the pursuit of health and happiness. 

General Principle 2. We are the chief advocates for protecting our 
patients' right to confidentiality. 

General Principle 3. Psychiatrists must never knowingly become a 
party to any manipulation of facts (as differentiated from with- 
holding information dictated because of confidentiaHty) in deal- 
ing with third parties. 

A. Unethical. 

B. Just as destructive to psychotherapist-patient relation- 
ship as breach in confidentiality. 

General Principle 4. Whatever is released to any third party needs to 
be discussed with the patient except in unusual circumstancs. 

Genera] Principle 5. When in the psychiatrist's judgment the patient 
represents an extreme danger to himself or others that cannot be 

33 



56-421 O - 80 ~ 28 



428 



Task Force Report 9 

contained therapeutically, and it is necessary to notify others of 
the hazard for the protection of the patient or these others, con- 
fidentiality should be broken only to the extent necessary. 

* * * • 

Specific considerations are mandated for certain required release 
of information. Absolute privacy is a thing of the past. The problem 
is to minimize the effect of disclosure on the patient. Requests for 
information from family members is one of the most frequent impo- 
sitions on confidentiality. In some situations, it may help therapy. 

Family Principle I. .The therapist must decide whether disclosure op- 
erates for patient or against patient. This applies to information 
to schools during therapy of children. 

Family Principle 2. Where family is involved, there should be prior 

agreement on standards of confidentiality that v^ill be applied. 

Corollary — Even v^hen total withholding of information is 

practiced, the involvement of family should not be ignored 

and they should be helped to whatever support they might 

need. 

• * * * 

Requests for information from insurance companies and/or em- 
ployers for treatment cost reimbursement has become the most fre- 
quent imposition on confidentiality, with proportionately grave 
interference with patients' welfare. 

Insurance Principle 1. Patients receiving care through any system of 
providing such care should have access to all medical services 
without jeopardizing their privacy or confidential relationship 
with their physician. 

Insurance Principle 2. The purpose of insurance is to minimize the 
risk and impact of calamity by spreading the risk. 

A. The patient stricken by illness in any form should not be 
penalized because he has added a "burden" to the group 
load. 

B. The patient as an individual should have confidentiality 
protected by considering group experience in all cost 
accounting procedures for whatever purpose. 

Insurance Principle 3. Treating psychiatrists will have to give some 
information if their patients are to have the benefit of insurance 
coverage. 

34 



429 



CONFIDENTIALITY AND THIRD PARTIES 

A. That a psychiatric condition, unspecified, exists. 

B. That symptoms began at an approximate date. 

C. General degree of unspecified impairment. 

D. General nature and frequency of treatment for billing. 

Insurance Principle 4. Under no circumstances should any sensitive 
information from treating physician, required for insurance pur- 
poses about an individual, be routed through or be made avail- 
able to employer. 

Corollary — Once it has served legitimate purposes through 
medical evaluation, no further use should be made in iden- 
tifiable individual recording or data storing. 

* * * * 

This will be even complicated v^ith advent of national health 
care coverage. There v^ill be storage of much individual intimate 
material. Who controls access to information is then vital. 

National Health Plans Principle 1. We must separate minimalized 
data needed to assure individuals' rights to care from the data 
needed for any statistical purpose of administration or research. 

National Health Plans Principle 2. The data to be recorded for all 
purposes, the protection of the data once recorded, and the limi- 
tations of its accessibility should be an immediate and integral 
part of the initial plan. 

* * * • 

The courts' demands for information is a less frequent occur- 
rence, but when it occurs can have a more devastating affect on the 
patient and his psychotherapy. 

Recent developments have been favorable. 

1. California Supreme Court limiting disclosure to bare mini- 
mum when exceptions to psychotherapist-patient privilege 
exist. 

2. Proposed federal code adopts limited psychotherapist-patient 
privilege. 

3. Illinois further limits the exceptions to privilege. 

Still needed: 

Elimination of patient-litigant exception to privilege where 
it exists, and legislation to grant psychotherapist-patient 
privilege in those states where it currently does not exist. 

35 



430 



Task Force Report 9 

Court Demand Principle 1, The psychiatrist, while honoring sub- 
poenas, should refuse, within the framework of the law, to di- 
vulge any information about a patient without the consent of 
the patient. 
Court Demand PrincipJe 2. If the situation involves a legal waiver of 
the need for the patient's consent, the psychiatrist still has the 
obligation to discuss the matter fully with the patient and the 
patient's attorney in order to be certain that all concerned under- 
stand the possible consequences of the release of information. 
CoTollaTy — The law in this area varies and sometimes a psy- 
chiatrist may be ordered to testify when he believes he 
should not. In those circumstances, he will have to judge 
whether he will legally challenge the court order and risk a 
contempt citation. He would be well advised to secure legal 
counsel first. 

* * * * 

Employers 

On jobs where emotional health is vital to carrying out grave 
responsibilities, the judgment of danger should rest primarily on ob- 
servable job behavior and not on the fact that an employee is or has 
been in treatment. It is to employer's benefit to encourage such em- 
ployees to seek early help for emotional problems. Any hazard to 
continued employment by disclosure from therapist will discourage 
seeking such help. (See General Principle 5) 

* * * * 

Schools and Psychotherapy of Children 

Principles relating to families apply here. A special problem is 
tendency of schools to develop permanent records that can be 
used on behalf of the child still in school, but which are available for 
misuse after the child leaves school. 

We believe the Commission on Children and Adolescents should 
explore this problem for recommendations (See List of Recommen- 
dations]. 

Appendix G; Testimony Submitted on Behalf of the American 
Psychiatric Association Sr The American Academy of Psychiatry 
and the Law on the Inclusion of a Strengthened Rule 504 
[Psychotherapist-Patient Privilege] in the Federal Code of Evidence 
H.R. 5463 

36 



431 



CONFIDENTIALITY AND THIRD PARTIES 

Maurice Grossman, M.D. 

Chairman, Task Force on Confidentiality 

as it Relates to Third Parties 

American Psychiatric Association 

& 

Clinical Professor of Psychiatry 

Stanford University School of Medicine 

Stanford, California 

Stanley L. Portnow, M.D. 
American Academy of Psychiatry and the Law 

& 

Assistant Professor of Clinical Psychiatry 

New York University School of Medicine 

New York City 

Presented June 5, 1974 Before the U.S. Senate Judiciary Committee 

Mr. Chairman and distinguished members of this committee, I am 
honored and privileged to appear before you in behalf of the Ameri- 
can Psychiatric Association, which represents 21,000 of the 25,000 
psychiatrists in the United States, and also for the American Acad- 
emy of Psychiatry and the Law. With me is Stanley L. Portnow, 
M.D., Chairman of the Committee on Psychiatry and the Law of the 
American Psychiatric Association, and also appearing in behalf of 
the American Academy of Psychiatry and the Law. 

Mr. Chairman, in addition to my statement, I request to have 
included in the record the references and attachments appended 
thereto. 

In proposing a strengthened psychotherapist-patient privilege 
rule, I find myself quite uncomfortable. In the current climate invok- 
ing privilege is a most delicate subject. Secondly, my discussion may 
sound critical of a fellow profession, our legal colleagues. The laws 
on privilege are written by lawyers, for practice by lawyers, and 
passed upon by lawyers sitting as justices. To the latter problem I 
can only claim that some of my best friends are lawyers, — not being 
entirely facetious since they helped me to the legal insights I will call 
upon. If these insights are faulty, it will be because of my difficulties 
and not their efforts to enlighten me. Addressing the first problem, 
the approach to the privilege I advocate bears no resemblance to the 
current legal contest. I plead for privilege, but not for protecting my- 
self, nor for psychiatrists as a group, nor for the medical profession. 
I plead for the protection of our patients. It would be far easier for 
any physician to hide behind the legality of a court subpoena, and 
simply turn over his records or freely testify. It is more arduous and 

37 



432 



Task Force Report 9 

onerous to fight against subpoenas to uphold the greater ethic of 
protecting our patients who have placed their trust in us. A psychia- 
trist has gone to jail, and others have risked jail to so protect their 
patients. Psychiatrists and other physicians have spent tens of thou- 
sands of dollars of their own money, — not to protect themselves, — 
to avoid harm befalling their patients in this struggle to seek protec- 
tion of confidential communications. 

In essence I am really calling on you to act as a jury to pass upon 
the question of whether the health, v/elfare, and very lives of our 
people are being adequately protected, — the theme of our Constitu- 
tion's Bill of Rights. The furor over one psychiatrist's office being 
invaded to get the records of one patient pales in the face of the fact 
that you will pass on the power to unlock every physician's file and 
mind about every patient's innermost fantasies, dreams, secrets and 
sorrows, and make them available to any lav^er, or prosecuting at- 
torney for whatever righteous or unrighteous reason he may have. 
Rule 501 offers no protection because state laws are so full of loop- 
holes they have been shown to be ineffective in actual practice 
(1). Approximately seven states have enacted psychotherapist-patient 
privilege laws (2), and these limit them to psychiatrists and psycho- 
logists; whereas proposed rule 504 included all physicians. Even so, 
at least in California, the patient-litigant exception has been used re- 
peatedly to act as a barn door wide opening to attack the protection 
of the whole record (3) in spite of a California Supreme Court ruling 
(4) that disclosure must be limited and discreet. 

I will not repeat endless evidence that effective psychiatric 
treatment rests on the patient's ability to unburden every thought, 
fantasy, feeling, wish to his therapist without restraint. This was 
documented by the Group of the Advancement for Psychiatry (5), 
acknowledged and accepted by the California Supreme Court in its 
Lifschutz decision (4), in the footnotes supporting Rule 504(1) as 
eventually proposed. There has been no argument refuting that this 
Rule 504 amply meets Wigmore's four criteria to support a privilege 
not to disclose confidential information (6]. 

Patients are not required to relate merely every fact, but every 
fleeting fantasy, wish, dream without restraint. This knowledge has 
often delayed people seeking help for years until the pressure of 
their misery drives them to chance trusting their physicians. They 
have already suffered hurt and distrust so trusting their psychothera- 
pist does not come easy. The preservation of the environment of 
trust that no revelation will be revealed to another is what makes 
the practice of psychiatry possible, — and I am convinced, all of 
medicine. From my years of general practice I became convinced, as 
are many physicians, that the trust our patients put in us contributes 

38 



433 



CONFIDENTIALITY AND THIRD PARTIES 



as much to the healing process as the chemicals we call drugs, or the 
surgical and other physical procedures, as effective as these physical 
agents have proven to be. Confidentiality is essential to the proper 
and adequate health care of all the people. 

If you reflect also on the nature of the communications, it in- 
volves not only the patients, but what they tell of their wives and 
husbands, their children and parents, their friends and enemies, their 
bosses and fellow workers. Much is fantasy and distortion, created 
by the fickle human mind. How many would want to be judged on 
the basis of every fleeting thought, wish, emotional impulse that occurs 
to them? Who would dare to have them exposed publicly? Yet this is 
the stuff of which psychotherapy communications consist. In treat- 
ment, the patient is urged actively not to censor, not to control, not 
to hold back such thoughts that you and I, if fortunate, hold back, 
laugh off, ignore, and never relate to anyone. The mere fact that they 
were driven to seek help only emphasizes how disturbing these have 
been. Patients have been driven to suicide because of inability to 
tolerate them. To contemplate open disclosure has driven people to 
suicide overwhelmed by real or imagined shame. To avoid disclosure 
many have suffered conditions and diseases that led ultimately to 
the destruction of their health and life. Many have eventually suf- 
fered destruction of careers, homes, and future. Actual disclosure 
has done the same. 

To add the threat that a legal demand can force such disclosures 
from a physician trusted not to do so, bound by ethics not to do so 
and not to harm his patients, compounds the problem for those who 
seek help. To relate cases where husbands have used such disclosed 
information to attack their wives, — or wives to attack husbands; 
where disclosure about parents have shattered the lives of children; 
or the effect on two lives by disclosure what one individual fantasied 
about someone close to him only begins to tell the story (3). A psy- 
chiatrist being forced to give a diagnosis or evaluation he has made 
of a patient, withheld from the patient because of the patient's emo- 
tional fragility to tolerate it at the time or to understand the signifi- 
cance of the information, is not only destructive to that therapeutic 
relationship but makes it impossible for that patient and many others 
to ever trust any other therapist. I have seen patients precipitated 
back into a psychosis that years of work had overcome. So much for 
the need for protection and the nature of the treatment process. 

What follows are some thoughts that you can best judge for 
validity. The problem is weighing the value of society's need to pre- 
serve that confidentiality versus what I beHeve is the legal right to 
discovery, — the search for the truth. I am not a legal scholar but my 
search has led to some reading. I understand the origins of the sub- 

39 



434 



Task Force Report 9 

poena, that stands for the compulsion to disclose, had its origin in 
the English Court of Chancery and rested on the King's right to de- 
mand disclosure (7). It isn't by chance that it became known as the 
Star Chamber; and Star Chamber proceeding developed a meaning 
well deserved [7]. However, my readings indicate that the demand 
for the truth can be traced back through the English system to eccle- 
siastical courts where exacting the truth by torture, ordeals of fire 
and morsel, and combat were considered worthwhile in placing 
"need for truth" as supreme. 

There are two parallels. The use of the subpoena to intimidate, 
frighten and hurt goes on. The niceties of Constitutional protection 
rigidly followed on the Washington scene are not adhered to so well 
in the average case. Even worse is the question whether the disclo- 
sures made during psychiatric treatment can be treated as fact, when 
fantasy and unconscious distortion play such a prominent role. I 
would ask you to give consideration to the nature of the evidence so 
produced, and how prejudicial it becomes. In fact by the introduction 
of such productions the chances are the proceedings are led away 
from the truth rather than to the truth. 

The next question that bothers me is how the Constitution is 
interpreted. Article VI states "This Constitution . . . shall be the 
supreme law of the land". As I have been given to understand, court 
procedures including the rights of discovery stem from old EngHsh 
law. The Constitution was written to protect the people from abuses 
of government as found in that English law based on the Royal pre- 
rogative. Again Amendment IX states without equivocation, "The 
enumeration in the Constitution of certain rights shall not be con- 
strued to deny or disparage others retained by the people." Since 
the Declaration of Independence, that twin foundation of our Repub- 
Hc states that life, liberty, and the pursuit of happiness are such in- 
alienable rights, and it seems appropriate that the Ninth Amendment 
makes these rights supreme in addition to the protection of the First, 
and Fourth Amendments. I believe I have emphasized and could fur- 
ther document that to withhold psychotherapist-patient privilege and 
physician-patient privilege violates just those rights to life, liberty 
and the pursuit of happiness, — especially so for the patients in the 
chambers of the psychiatrist, but not restricted to that branch of the 
medical profession. 

My initial reference to the legal profession has to do with my 
perplexity in coping with legal logic. I understand that legal scholars 
have their own problems in resolving such dilemmas. Every argument 
I have read supporting lawyer-client privilege, if removed from the 
title identifying what is being defended, could apply verbatim to 
psychotherapist-patient privilege with even greater validity (8). I 

40 



435 



CONFIDENTIALITY AND THIRD PARTIES 

understand the American Bar Association has been critical of Rule 
504. 1 have not heard they have come out against lav^ryer-client privi- 
lege. Rule 501 would establish lawyer-client privilege nation-wide 
via all state statutes. The Supreme Court has held that the lawyer's 
records are his work products and therefore are not subject to sub- 
poena for evidence about his client (9]. The courts do not do the 
same for the psychiatrist's records in spite of two factors more perti- 
nent than those that apply to lawyers. The psychiatrist records his 
spontaneous impressions of what he thinks the patient is really ex- 
pressing and thinking, which is not exactly what the patient's words 
were (so called "interpretation of the contents"), — therefore a prod- 
uct of the psychiatrist's mind. Secondly, many psychiatrists keep no 
records at all of the patient's communications, demonstrating that the 
records are not for the benefit of the treatment or the patient, but 
for the study of the psychiatrist's own functioning and interpreta- 
tions for ultimate verification. Thereby that patient and all subse- 
quent patients benefit. To force all psychiatrists to give up record 
keeping would be a disservice to the research, teaching and improve- 
ment in the practice of psychiatry. 

I would request the Committee to ask themselves what factors 
might influence the weighing of the two constitutional values in- 
volved. This request might also be considered by the American Bar 
Association. Originally the Federal Procedural Code insisted that a 
subpoena could be issued only by "showing good cause" (10). Court 
interpretations established that this required more than mere rele- 
vance to the issue; and required that there must be evidence the infor- 
mation was vital to the preparation of the case (11). In 1970 this 
Fourth Amendment protection was dropped. The Advisory Commit- 
tee on Rules, after giving legal justification added, "(because) it re- 
flects existing law office protocol" (12). I am sure this Committee 
and the Congress as a whole would not subordinate the First, Fourth, 
and Ninth Amendments of the Constitution to the convenience of the 
law office, to ease the efforts of practicing lav^ers, let alone the 
support of interested groups who profit from using the threat of 
disclosure. 

I am requesting you put a firm lock on the offices and minds of 
all physicians so that predators cannot invade the rights protected 
by the First, Fourth and Ninth Amendments through the legal per- 
mission of those trying to support justice in the courts. It is impor- 
tant to weigh whether the remedy for justice in seeking the truth 
does not create greater injustice reaching out to multitudes not even 
directly involved in the specific court action. 

I would further implore that you strengthen the lock that is Rule 
504 in two ways. This need is suggested by actual experience in the 

41 



436 



Task Force Report 9 

California courts. Illinois recognized this when their legislature al- 
most eliminated entirely the patient-litigant exception (section (d) (3) 
in 504). They finally compromised for divorce and child custody 
cases (13). The California Supreme Court tried to correct this in its 
Ldfshutz decision, but lower courts have been unable to apply the 
rule suggested. A substitute for Rule 504 (d) (3), patterned after Sec- 
tion 408 (b) (2) (C) of P.L. 92-255 might be more helpful to the courts 
(14). This section 408 has held up well in courts. Otherwise the ills 
already demonstrated by the operation of a blanket waiver will con- 
tinue to plague the courts. It places the patient wise enough to seek 
help in a position unfavorable to those who needed but avoided such 
help (15). The rights to the courts should not be conditional. It results 
in unequal application of the law. It has deterred people from seek- 
ing help as they pursue just claims. Evidence can and has been se- 
cured from sources other than the treating psychiatrist, but this has 
not stopped the inroads of confidentiality of the treatment relation- 
ship even in those states having protective privilege laws. 

The argument presented that it permits scoundrels to hide be- 
hind the protection of the law (16) is a specious one. There are such 
cases. First, are the many to be harmed because of the few who may 
so try? Secondly, in each such case, there was a lawyer who took and 
filed the action before the physician was brought in. I leave the in- 
ference to you to avoid sticking my neck out any further. 

To strengthen the lock even more, the original proposal for Rule 
504 extended the protection to all physicians. In the few states hav- 
ing any protection it is limited to psychiatric physicians. The 504 
wording in Section (a) "while engaged in the diagnosis or treatment 
of a mental or emotional condition" overlooks the frequent phenom- 
enon that disclosure of a communication or finding of a condition 
might precipitate a mental or severe emotional condition, — some- 
times if only revealed to the patient (e.g. labels of syphilis, gonorrhea, 
pregnancy, schizophrenia, latent homosexuality). I would suggest a 
modification of the wording to foresee these possibilities (17). 

The question of extending the right to claim the privilege to the 
therapist is a moot point (see addendum). The protection is always 
of the patient and the patient's right. Extending to the therapist the 
right to claim the privilege seems indicated when the patient is in- 
competent to understand the consequences (e.g. mentally incompe- 
tent; having no knowledge of what he has actually communicated or 
therapist's observations and judgments withheld from patient because 
of patient's condition). Here we have a situation lacking informed 
consent. The other situation is where the patient's attorney is more 
concerned with a settlement (usually in contingency cases) than he is 
in what happens to his client. This latter is a question for the legal 

42 



437 



CONFIDENTIALITY AND THIRD PARTIES 

profession to determine whether they want a physician to protect 
the client from his own lawyer. These situations do exist. 

In summary I ask that you review the nature of the psychother- 
apeutic process; its dependence on trust that requires confidentiality; 
the nature of the evidence that would be labelled, used and misused 
as "fact" or "truth"; the availability of other sources of information. 
I also ask that you consider the effect of threatened exposure on 
those needing, seeking, or already in the process of treatment; in 
that light to recognize Wigmore's four postulates for privilege have 
been met even better for Rule 504 than for lawyer-client privilege. I 
would ask that you review the history of "ascertaining the truth in 
the courtroom" in juxtaposition to the protection sought by the fram- 
ers of our Declaration of Independence and the Constitution. As a 
result I do hope you will restore a stronger lock for the protections 
in those documents by restoring a strengthened psychotherapist- 
patient privilege in the Federal Code of Evidence. I can do no better 
than to quote from David W. Louisell's review of opinions ". . . that 
whatever handicap privilege places upon adjudicatory process is not 
too high a price to pay for preserving inviolate certain essential rela- 
tionships." (18) Preserving life, health and the pursuit of happiness 
should stand high in priority for such consideration. 

Mr. Chairman, I also wish to emphasize to this committee that 
the inclusion of the psychotherapist-patient privilege can be inserted 
in addition to the traditional physician-patient privilege which must 
not be impaired in any way. 

REFERENCES 

1. Committee on Rules of Practice and Procedures, Judicial Conference 
of the U.S., Preliminary Draft of Proposed Rules of Evidence for the 
U.S. District Courts and Magistrates, footnotes Rule 504 (1969, p. 53). 

2. California, Connecticut, Florida, Georgia, Illinois, Kentucky, Massachu- 
setts. 

3. Slawson, P.F., "Patient-Litigant Exception," Arch. Gen'I Psychiatry 
21:347; Sept. '69 — Slovenko, Ralph, "Psychiatry and a Second Look at 
the Medical Privilege," 6 Wayne L. Rev. 175-188 (1960) — Robertson 
and Caesar cases that reached California Supreme Courts; references 
are not available but can be secured if needed. 

4. re Lifschutz 2 Cal. 3d. 415, 467 P. 2d 557, 85 Cal. Rptr. 829 (1970) ; Roberts 
V. Sup. Ct. 9 C 3d. 337 (Calif. Sup. Ct. 4/11/73) — Louisell, David W. & 
Sinclair, Kent. Jr., "The Supreme Court of California," 1969-70," 59 
Calif. L. Rev. 30, Jan. 1971. 

5. "Confidentiality and Privileged Communication in the Practice of Psy- 
chiatry" Report No. 45, Group for the Advancement of Psychiatry, New 
York, 1960. 

43 



438 



Task Force Report 9 

6. 8 Wigmore Evidence, Section 2285, p. 527 (McNaughten rev. 1961] 

(1] Originates in confidence it will not be disclosed. 

(2) Confidentiality essential to the relationship. 

(3) The relationship should be fostered for the welfare of society. 

(4) The injury to the relationship greater than benefit gained to litiga- 
tion by the disclosure. 

7. Plunknett, Theodore F.T., A Concise History of the Common Law 4th 
ed. 1948 p. 172. — Webster's New International Dictionary of English 
Language unabridged, 2nd ed. 1960, p. 2458, G.&C. Merriam Co., 
Springfield, Mass. — Oxford English Dictionary, V.9, Pt.l, 1919, p. 833 
ed. by Henry Bradley. 

8. Compare: 

Slawson, supra 3, p. 352, quoting Lord Justice Knight Bruce. Doyle, Vin- 
cent, "The Privacy of the Individual," World Med. J. 21 :p. 33 March 
April 1974, same quote. 

9. Hickman v. Taylor, Jan. 1947, 329 U.S. 495, 67 S. Ct. 385 "Not even the 
most liberal of discovery theories can justify unwarranted inquiries 
into the files and mental impressions of an attorney." 

10. Federal Rules Civil Procedures, Rule 34 28 USCA. 

11. Fastener Corp. v. Spotnails, Inc. D.C. 111. 1967, 43 F.R.D. 204 U.S. v. Am. 
Optical Co. D.C. Cal. 1966, 39 F.R.D. 580. 

12. See Ref. 10 supra notes to amendment March 30, 1970 Advisory Com- 
mittee on Rules — "The revision of Rule 34 to operate extrajudicially 
rather than by court order reflects existing law office protocol" (empha- 
sis added). 

13. State of Illinois Statutes, Chapter 51, Evidence & Depositions, Section 
5.2 [c) as amended 1971 — Beigler, Jerome S., "The 1971 Amendment of 
the Illinois Statute on Confidentiality: A New Development in Privilege 
Law," Am. J. Psychia. 129:3, p. 311, Sept. 1972. 

14. In re Lifschutz supra 4, footnote 26. 

Suggestion for wording 504 (dl (3) — "When patient injects the issue of 
his mental or emotional state as a claim or defense the privilege will 
be waived only if a court of competent jurisdiction considers there is 
insufficient necessary evidence from sources other than the psychother- 
apist. In assessing such good cause the court shall weigh the public in- 
terest in protecting such communications, and the need for disclosure 
against the injury to the patient, to the psychotherapist-patient relation- 
ship and the effect on the treatment process. Even so, disclosure must 
be directed at specific questions that need answers." 

15. Roberts v. Sup. Ct. supra 4. 

Grossman, Maurice "Proposed Federal Code of Evidence Rule 504 — 
Psychotherapist-Patient Privilege" Feb. 23, 1973, unpublished copy 
attached. 

16. Wigmore, supra 6, Section 2220, p. 183. 

44 



439 



CONFIDENTIALITY AND THIRD PARTIES 

17. Suggested wording — ". . . while engaged in the diagnosis or treatment 
of a mental or emotional condition, or receiving information that might 
precipitate a mental or severe emotional condition." 

18. Louisell, etc. supra 5, p. 53. 

ADDENDUM TO TESTIMONY 

Case for the Psychotherapist Exercising the Right to 
the Privilege in Order to Protect the Patient 
Maurice Grossman, M.D. 

I v^ould prefer to viev*^ the therapist exercising the right of privi- 
lege from another viewpoint, which was alluded to in Lifschutz's 
pleading, but received inadequate consideration in the Court's dis- 
cussion of its decision. It would be based not on his rights, but on his 
obligation. Apart from his obligation to maintain a "safe atmosphere" 
for all prospective patients, he has an obligation to protect the indi- 
vidual patient even from the patient himself. The extreme case obvi- 
ously is in the act of attempting suicide. But the same factors operate 
in other less manifest ways. This leads to my second approach to the 
problem. 

The legal process sees every individual as competent to make 
decisions and therefore responsible for those decisions. Obviously, 
our society could not operate on any other basis. Yet the law recog- 
nizes that this is not so in certain circumstances. The gross circum- 
stance of legal insanity and the resultant various complications of 
legal competence is the most obvious. The guiding principle rests on 
the relevance of the mental state to the act in question. The individ- 
ual's mental ability to adequately judge and control his act is the 
guiding principle. In psychotherapy the patient is encouraged to drop 
alJ intellectual controls and to say anything that comes to his mind 
without censoring by reason or fact. In the process he drops all 
"adult," "mature" controls and regresses to earlier childhood and 
even infantile states of thought production and their verbalization. 
He might then release immature, even irrational emotional urges, 
impulses and thoughts. More important, he might, and often does, 
associate these infantile resurgences to present day activities in his 
verbal productions in the therapeutic session. The examination of 
these irrational impulses in the light of rationality, with the therapist's 
help, is the important instrument in therapy. Sometimes there is a 
tendency for the patient to "act out" these irrational impulses in 
everyday life. There is a cardinal rule for patients to avoid commit- 
ting themselves to any irreversible act while in therapy until the 
irrational elements are understood. The reason for this is that all 
patients in intensive therapy, and to some degree all patients in any 

45 



440 



Task Force Report 9 

psychotherapy, regress to these earlier states of feeling, thinking, and 
even functioning. In the course of this they sometimes act as various 
members of their childhood family, as they saw themselves then, or 
as they fantasied themselves in wishful thinking. 

In other words, encouraged to drop controls they regress to 
where these productions are neither wholly factual or within their 
reasoning control. The psychological processes of repression and de- 
fensive distortion are accentuated during therapy, and only the ther- 
apist stands as their protector against their irrational self. The patient 
endows him with the cloak of a benevolent, non-punitive, protecting 
parent. It is this role that permits him to be effective. It is this role 
he must not jeopardize. 

The law recognizes that at certain ages children are incapable of 
being held responsible. Many of the assertions of patients are from 
the childhood points of view. To take their utterances during a 
psychotherapeutic session as responsible fact would ignore the re- 
ality of the therapeutic scene. 

The mere fact that they sought treatment is evidence enough 
that their conscious behavior and reactions were having irrational 
consequences. It is this more or less unconscious awareness of the 
irrationality of some segment of their being that makes patients re- 
luctant to even disclose they seek the help of a psychiatrist. 

I would then suggest that consideration be given to the psycho- 
therapeutically induced intrapsychic state of the patient at the time 
he makes statements to a therapist; that it be viewed in the light of 
regressed distortion; and that it is a mixture of fact, fantasy and dis- 
tortion that should not be acceptable as "evidence of fact." On this 
basis, in court, the therapist is in a position where he must protect 
the patient from having the proceedings of the therapeutic process 
taken at face value. The patient may not even know what he is actu- 
ally saying or intending to do. Not infrequently in practice, patients 
are amazed at recorded statements and cannot explain how they 
came to say them. The therapist uses them as guideposts to the un- 
conscious. To treat them as a "fact" in court would be a perversion 
of justice. At times patients will demand the therapist support lines 
of action that the patient is convinced is essential for his well-being. 
When the patient proceeds even after the therapist points out the 
irrational driving force, he might still attack the therapist for not 
having stopped him, if the act backfires. 

The summation of the above is to support the proposition that 
the therapist needs the right of privilege to permit him to adequately 
exercise his responsibility as the protector of his patient, even from 
the patient himself. He must always refuse to testify on broad prin- 
ciple to make sure refusal in specific cases is not taken as an admis- 

46 



441 



CONFIDENTIALITY AND THIRD PARTIES 

sion of some secret forbidding trait in a specific patient. 

The question of informed consent as applied to waivers of privi- 
lege by patients in therapy is an entirely different aspect. The above 
discussion would be relevant to that. The reliance on the patient's 
waiver might well be questioned in this approach. 

Some clinical examples are: 

1. Patient reacts to current situation that evokes unconscious 
memory of childhood trauma and anger. Statements in ther- 
apy taken out of context of the therapeutic scene, would be 
a gross distortion of actual behavior on job. Yet he feels tre- 
mendous guilt about job performance based on his child- 
hood guilt. His statements, in court, could be used by adver- 
sary as though they were facts, confusing a jury. 

2. Those patients, because of neurotic needs, repeatedly feel 
they are committing grave crimes. The extreme are innocent 
individuals who come to confess they might be the culprit 
in publicized crimes. Lesser versions of these are apparent 
in other self-blame statements during therapy, especially 
when pushed into taking aggressive action like filing a law- 
suit. And these are not psychotic individuals. 

3. Freud's famous experience of adult patients reporting they 
had been raped at time of puberty; and his eventual realiza- 
tion they were reporting fantasies as though they had been 
real. 

4. Those patients signing for release of information by therapist 
under social pressure (boss on job, husband of wife-patient); 
or the passive submissive patient who literally cannot refuse; 
and both groups depending on the therapist stepping in to 
say "No." 

5. The insurance company refusing to pay for covered treat- 
ment, asking more and more details of the case. To file suit, 
the patient jeopardizes his privacy. In two instances, both 
non-psychiatric, the claimant dropped the issue without re- 
covering his payments, out of fear of upsetting his employer 
who had the insurance contract. 

6. Slawson's case is still relevant, even though divorce pro- 
ceedings have changed. A patient's inability to collect insur- 
ance because to report desired information, would be through 
husband, the insured one, and might be used by him in 
child custody proceedings. In the one I know, the fear of it 
being used was based on unconscious dread, rather than any 
real danger; but the effect was equally as destructive at that 
stage of treatment. 

47 



442 



Task Force Report 9 

7. The hypothetical school teacher suing for his job. The school 
administrators use knowledge of the teacher using group in- 
surance for psychotherapy, demand the record to support 
their contention of unfitness, rather than testimony of actual 
job performance deficiencies. I would guess that the average 
judge would admit the whole record. There have been re- 
ported instances of misuse of psychological tests in basing 
action on such words as "latent homosexuality," "high on 
femininity scale" for men, "aggressive tendencies," etc. In 
court, any expert evidence that the terms have no relevance 
separated from any overt behavior, would not reduce the 
impact of such terms on a jury. 

ADDENDUM TO TESTIMONY 
Pub. Law 92-255, March 21, 1972 

#408. Confidentiality of patient records. 

(a) Records of the identity, diagnosis, prognosis, or treatment of any 
patient which are maintained in connection with the performance 
of any drug abuse prevention function authorized or assisted under 
any provision of this Act or any Act amended by this Act shall be 
confidential and may be disclosed only for the purposes and under 
the circumstances expressly authorized under subsection (b) of this 
section. 

(b) (1) If the patient, with respect to whom any given record referred 
to in subsection (a) of this section is maintained, gives his written 
consent, the content of such record may be disclosed. 

(A) to medical personnel for the purpose of obtaining benefits 
to which the patient is entitled. 
(2) If the patient, with respect to whom any given record referred 
to in subsection (a) of this section is maintained, does not give his 
written consent, the content of such record may be disclosed as 
follows: 

(A) To medical personnel to the extent necessary to meet a 
bona fide medical emergency. 

(B) To qualified personnel for the purpose of conducting 
scientific research, management or financial audits, or pro- 
gram evaluation, but such personnel may not identify, di- 
rectly or indirectly, any individual patient in any report of 
such research, audit, or evaluation, or otherwise disclose 
patient identities in any manner. 

(C) If authorized by an appropriate order of a court of com- 
petent jurisdiction granted after application showing good 
cause therefor. In assessing good cause the court shall 
weigh the public interest and the need for disclosure against 

48 



443 



CONFIDENTIALITY AND THIRD PARTIES 

the injury to the patient, to the physician-patient relation- 
ship, and to the treatment services, (emphasis added) Upon 
the granting of such order, the court, in determining the ex- 
tent to which any disclosure of all or any part of any record 
is necessary, shall impose appropriate safeguards against 
unauthorized disclosure. 

(c) Except as authorized by a court order granted under the subsection 
(b) (2] (C) of this section, no record referred to in subsection (a) 
may be used to initiate or substantiate any criminal charges against 
a patient or to conduct any investigation of a patient. 

(d) The prohibitions of this section continue to apply to records con- 
cerning any individual wfho has been a patient, irrespective of 
whether or when he ceases to be a patient. 

(e) Except as authorized under subsection (b) of this section, any per- 
son who discloses the contents of any record referred to in subsec- 
tion (a) shall be fined not more than $500 in the case of a first of- 
fense, and not more than $5,000 in the case of each subsequent 
offense. 

ADDENDUM TO TESTIMONY 

PROPOSED FEDERAL CODE OF EVIDENCE 

RULE 504 — PSYCHOTHERAPIST-PATIENT PRIVILEGE 

This rule for privilege in psychotherapy recognizes Constitutional 
ground for such protection.* Not to grant such privilege would inter- 
fere writh the rights of an individual to seek health and protect life 
because it is recognized that patients requiring psychiatric care would 
be reluctant to seek such care unless they were assured that disclo- 
sure of embarrassing or damaging material would not get beyond the 
physician they are consulting. Furthermore, for psychotherapy to be 
effective, it requires that patients hold back no material and disclose 
everything and anything that is involved in their emotional pro- 
cesses. Here again, this would not be possible unless the patients 
really were assured that there would be no release of such informa- 
tion beyond the therapist. This was recognized in the deliberations 
of the California Supreme Court in the Lifschutz case. 

Based on these same principles, a similar law was first passed in 
Connecticut and was considered by all concerned, both in the legal 
and psychiatric professions, that it offered adequate protection to 
patients and the law. A similar law was adopted in California and is 
now part of the California Code.** A similar law was passed in Illi- 



*California Supreme Court decision in Lifschutz. 2 Cal. 3d, 431-32, 437, 467, P. 2d 
at 567-68, 571-72, 85 Cal. Rptr at 839-40, 844. 
**1970 Revision Article 7, Sections 1010-1028. 

49 



56-421 O - 80 — 29 



444 



Task Force Report 9 

nois, and in 1971, amendments were necessary based on problems 
created by the law, based on the exceptions to the privilege that were 
incorporated as part of the basic law. These same problems have de- 
veloped in the application of the Code in CaHfornia. The source of 
the problems are the exceptions, based on the patient's mental or 
emotional condition being entered by the patient as an element of a 
claim or defense (California Section 1016; Federal Code Rule 504 
(d)(3)). 

The legal philosophy for this exception is that if patients use 
their psychiatric condition for a claim or defense, the truth concern- 
ing this requires access to all the material bearing on this; and that 
patients need not make the claim and can so preserve their confiden- 
tial disclosures. In practice, it turns out that, because of this, patients 
are given the choice of pursuing just claims under conditions of 
costly emotional damage; or to forgo just claims, — conditions not 
suffered by claimants not in treatment. 

Furthermore, this concept treats the disclosure of patients dur- 
ing treatment as facts that are of reliable truth. The actual nature of 
the revelations of patients in therapy are far from fitting these 
critera. The patients' emotional involvement in the material of dis- 
closure results in distortions and often outright untruth, uncon- 
sciously produced, that are part of their neurotic or psychotic pro- 
cess. This is compounded by the nature of the therapeutic process 
that encourages patients to regress to childhood states during therapy 
in order to reach hidden childhood factors involved in their psychia- 
tric problems. This forces the patient to drop all adult reality controls 
that keep healthy adults' thoughts and utterances in truthful per- 
spective. 

The California Supreme Court in the Lifschutz case recognized 
some of these factors, with particular reference to the extreme dam- 
age that could be done to such patients if their therapists were to 
disclose material given in such confidence. They tried to bridge the 
two factors involved, — that is, the patient's need for protection and 
treatment and the court's need for information, — by determining 
that disclosure should be restricted and limited to that information 
relevant to the proceedings. This decision seemed to resolve the 
problem, except that in practice in courtroom proceedings almost 
immediately following this decision of the California Supreme Court 
defendants (their insurance company attorneys) have insisted on free 
right to full disclosure, even in depositions, forcing psychiatrists to 
protect their patients at considerable hardship to themselves (Lif- 
schutz going to jail, he and at least two others being forced to go 
through appeals that were more costly in time involvement than the 
$10,000 to $25,000 legal expenses each incurred in protecting their 

50 



445 



CONFIDENTIALITY AND THIRD PARTIES 



patients]. 

In the case of Dr. Robertson, when the Cahf ornia Supreme Court 
accepted the appeal to review an adverse decision of the lower ap- 
pellate court, the defendant settled for the original claim amount 
rather than risk a Supreme Court decision, suggesting the exclusion- 
ary section is used for harrassment of the patient and psychiatrist. 

In actual proceedings, patients claiming their psychiatric condi- 
tion in issue, still have to prove relevance and truth of such claim. 
Expert testimony other than their psychiatrist can be subject to cross- 
examination; or the patient can resort to the doctrine of res ipso 
Joquitor. Therefore, sources other than the therapist are available for 
ascertaining the truth of the issue. In Dr. Robertson's case, a non- 
treating psychiatrist had examined the patient, was being used for 
the plaintiff, and was available for cross-examination. In another 
case involving a Dr. Caesar, an eminent psychiatrist called by the 
plaintiff patient, testified that the patient's mental state was not due 
to the accident in question, but the defendant's attorneys still pressed 
disclosure from the therapist. Dr. Caesar, — again suggesting harass- 
ment as a threat to psychiatric patients who sue. 

Another problem has to do with legal view and legal procedures 
handling such information. If such information can be elicited in dep- 
osition where there is not the protection of the court itself, even 
though this information may be stricken from the record based on 
both the law and judicial protection, the damage to the patient has 
already been done. We have record of cases where such depositions 
were read in court with damage to the patient, and even though the 
information was then stricken from the record for legal purposes, the 
psychiatric damage had already been incurred. The question of legal 
admissibility and reversal is an entirely different problem from pro- 
tecting the patient from breaches of confidentiality of the material 
given in private to their treating psychiatrist. 

In North Carolina and in the section protecting confidentiality 
in the federal law setting up the Office of Drug Abuse Control and 
proposed legislation for Veterans Administration drug abuse treat- 
ment programs, protection was dependent upon requiring the judge 
in court to make a determination whether there were overriding 
needs for information that warranted intrusion and destruction of 
the patient's need for confidentiality. In the drug abuse program, the 
need was not really for the protection of the patient, but the recogni- 
tion that the whole program and its success was dependent on pa- 
tients feeling secure that their seeking treatment and records of 
treatment would not result in legal and other civil problems. As noted 
from the attachment, it can be seen that even this failed in New York 
City, where the trial court judge and the Appellate Division of the 

51 



446 



Task Force Report 9 

New York State Supreme Court ruled that the photographs of all 
patients in the treatment program be made available to witnesses 
and legal authorities in a hunt for a suspected murderer. At last 
word, this was being requested for review by the New York State 
Supreme Court, with consideration of appealing to the United States 
Supreme Court if necessary. 

Additional attention is needed to the problem of protecting pa- 
tients in psychotherapy, not from the intent of the law, but from how 
it works out in actual practice. 

Maurice Grossman, M.D. 
February 23, 1973 



52 



447 



CONFIDENTIALITY AND THIRD PARTIES 



Appendix H; Samples of Reports From Psychiatrists of Injuries 
to Patients Resulting From Breaches of Confidentiality 
Compiled hy Maurice Grossman, iVI.D. 
Chairman of the Task Force 

In the following illustrations, distortions have been purposefully 
made to disguise identification and in some instances the essential 
facts are gleaned from multiple cases. 

1. A 24 year old schizophrenic patient, receiving EST in hospital 
improved and was able to return to work. Patient not told 
actual diagnosis because of still fragile state. Insurance 
covered patients routinely are given forms to sign on hospital 
admission. Includes permission to give information to insur- 
ance company. Hospital sent a report of the hospitalization 
as routine matter to get payment for bill, including diagnosis 
and suicide attempt. On return to work, patient found that 
fellow employees knew of the hospitalization, the incidents. 
Insurance company sends report to employer on group con- 
tract coverage. Patient becomes paranoid toward her physi- 
cian; expresses self about first learning about herself from 
fellow employees; terminates treatment. 

2. Similar case, with patient learning of diagnosis with notice 
from insurance company reporting they had paid the bill. 
Patient paranoid about how insurance company, and "their 
clerks" knew all about it. 

3. A very emotionally upset patient, first making inquiries from 
insurance company that no information would reach em- 
ployer, was so assured. The entire therapy damaged, and pa- 
tient worse when finds employer discloses knowledge of the 
treatment and other factors. Medical Director of the national 
company involved, and a high official in insurance organiza- 
tions writes "we are obligated to tell the employer because 
he pays the premiums." (Note that such group contracts are 
fringe benefits paid for by employees labor, and are only 
administratively paid for by employer.) 

4. Patient called in for questioning about insurance report of 
psychiatric illness relative to security clearance even though 
no interference with work. Incident to security investigation, 
neighbors were asked what they might know about any psy- 
chiatric problem about this patient. 

5. Reports of employers looking for excuses to separate em- 
ployees based either on prejudice about psychiatric illness 
or unwarranted concern they will add burden and increased 

53 



448 



Task Force Report 9 

insurance premiums on group policy. 

6. One patient, spouse of employee covered by group contract, 
required intensive treatment because of extreme emotional 
decompensation, — barely holding together and very de- 
pressed. When husband filed claim for the costs of treatment 
covered by policy, he was told that employer wrould be told 
of his claim; that employer v^ould be required to increase 
premium payments on all employees (declared not to be a 
fact by insurance industry representatives when discussed 
with them later) ; and intimidated him into dropping the claim 
out of fear of losing job. The physician was dissuaded from 
making follow-up inquiries both by husband and wife out of 
fear of losing job. Patient became worse. 

7. School systems who routinely turn down applications for 
teaching positions on any history of psychiatric care, derived 
from insurance questionnaires, without investigating the na- 
ture of the condition or treatment to determine whether it 
would have a deleterious effect on their teaching or contact 
with children. Many in treatment are better teachers than 
those who avoid it. 

8. Many government agencies routinely request information 
about psychiatric treatment. If ignored, and later insurance 
information based on group policies discloses it, they may be 
separated on that ground. If they admit that they had treat- 
ment, they do not get job in first place. No effort is made to 
have individual examined to see how relevant the history is 
to present condition or job. (Incidentally I have found that 
the Department of Defense Industrial Security Review Agen- 
cies is the most careful to protect the confidentiality of ma- 
terial from employers and to evaluate current condition in 
relation to the job. The one difficult problem still is that of 
those who admit to homosexuality. I understand the Civil 
Service Commission has just agreed to drop this section of 
the questionnaire for job applicants, and rely on current 
examinations.) 

9. Two high officials in the Department of Defense, defending 
the practice of SPN identification on conditions of discharge 
that includes medical data, unequivocally declared before a 
Senate Committee that they feel obligated to tell employers 
of the reasons for his discharge, when the discharged military 
person, returned to civilian life, seeks employment. (Again, I 
understand that recently the use of SPN identifications have 
been dropped; but the question of attitude remains open.) 

54 



449 



CONFIDENTIALITY AND THIRD PARTIES 

10. Records of a child's psychiatric condition and treatment 
made a permanent part of that child's school file when the 
treating psychiatrist has consultation with the current school 
teacher and parents, are often used in later years by others 
not having the benefit of the psychiatrist's help in under- 
standing the information; nor allowing for changes as the 
child progresses; and has even been turned up in search for 
information in the adulthood of the patient long after school 
years. 

11. Patients returned to stability and able to work, forced back 
into their psychotic state by misuse of material released from 
insurance files, security clearance files, that reaches other 
parts of employment situation. Undoing years of therapy is 
only part of the price. Suicide attempts; homicidal threats 
based on paranoid upheavals; all generated by real attitudes 
about them from fellow employees who repeat the informa- 
tion for either sadistic or thoughtless reasons. 

12. Since spouses are often the ones covered by the group 
policy and many insurance reports are required to go through 
the plant's personnel office, even a diagnosis can cause 
trouble. Not infrequently there is already some trouble in the 
family. The "well" member is not above using the fact of 
treatment to blame the "patient" for all the difficulty merely 
because the "patient" has been the one to accept the treat- 
ment. There have been cases where the spouse has used the 
diagnosis to threaten the "patient" as a means of dominating 
the household situation, even after the "patient" has re- 
covered and become constructively functioning. 

13. A variation of this is where the insured spouse seeks di- 
vorce, and threatens or actually seeks custody of children. 
When the insurance report indicated merely that an emo- 
tional condition existed, but that the physician would discuss 
it directly with the medical director on condition that it 
would not be disclosed elsewhere, the insurance company 
refused to pay the claim. The husband kept threatening the 
wife, to get a report for him to turn in through employer 
channels. A "secret" insurance company memo about the 
treating physician went through channels to the employer, 
got to spouse, who showed it to patient, who showed it to 
M.D., example of how protected their records really are, even 
when it concerns themselves. 

14. This last case represents another problem. When it was dis- 
cussed with the insurance commissioner of that state, he 

55 



450 



Task Force Report 9 

replied it was an individual matter and that payment would 
have to be sought in the courts. However, laws on privilege 
would require opening up the entire record in court, so that 
the damage would again be done. It has been found that de- 
tailed questionnaires are designed mostly for that purpose. 
Even if sued, the insurance company would merely have the 
same amount to pay and most people fearing the disclosure 
merely drop their claim for reimbursement. 

15. There are many patients, covered by insurance, who will not 
use their benefits because it will get back to employer. We 
receive reports that there are many more, who need care, but 
cannot afford it unless paid for by the insurance they have, 
but forego treatment rather than take a chance. 

16. We have other reports from reliable sources, but which can- 
not be documented for obvious reasons, of people greatly in 
need of treatment, but because of critical nature of their 
employment, avoid treatment out of fear of disclosure from 
any source. Such groups are commercial pilots, military of- 
ficers, certain professional men and women, people in high 
executive positions or on their way up the executive ladder. 
They can point to instances of those they know who chanced 
treatment, only to have leakage of information from some 
source interrupt their career. 

17. These are not restricted to psychiatric cases alone. A surgeon 
hospitalized for a coronary attack, learned shortly after he 
was home that his automobile insurance had been cancelled. 
His broker informed him that his automobile insurance car- 
rier had gotten word of his coronary through means of his 
hospital insurance report. 

18. One of the patients listed above told of a claim for corrective 
eye surgery on a child that was refused by the insurance com- 
pany although supposedly covered; and the family dropping 
the claim fearing repercussions from the employer. This was 
at a critical employment crisis in the industry. 

19. A patient applied to her physician for a physical examination 
for life insurance. When her application was turned down, 
her agent obtained a full report for her, and indicated that 
her physician was responsible. That terminated that rela- 
tionship. The physician reports he couldn't understand the 
rejection on his report per se. 

20. At the March 1974 C.M.A. Annual Meeting, at a reference 
committee hearing, a physician reported a case who died, and 

56 



451 



CONFIDENTIALITY AND THIRD PARTIES 

whose life insurance payment was refused. Many years be- 
fore in the course of some other illness, he noticed a benign 
nodule that was not treated. When the patient applied for 
insurance the nodule was not listed among old conditions. 
Since her application was less than two years before her 
death, payment was refused on the basis of a fraudulent ap- 
plication even though it had no bearing on the cause of death 
and was so unimportant the patient probably forgot it. The 
information came from one of the insurance data storage 
centers, or in the course of investigation, using the blanket 
consent form, they searched old records and found reference 
to it in list of diagnoses. 

21. One report is of a hysterical patient with hypochondriacal 
symptoms who had, as a result, many bouts of surgery. After 
a year or so of treatment, with focusing on underlying prob- 
lems, the symptoms and the surgery came to an end. When 
the patient began using insurance, a demand was made for 
an official diagnosis. The physician used "Hysterical Per- 
sonality Defect". Through some way unknown to the doctor, 
the actual diagnosis became known to the patient. In her fury 
she immediately stopped treatment. The next he heard she 
was back visiting surgeons again. 

22. A patient who had been hospitalized for severe emotional 
disorder had had extensive psychological testing done at the 
hospital. A claim for hospital payment had been sent in by 
the hospital. Again, as often demanded by carriers, the hos- 
pital sent along a full report. For some reason they even sent 
a copy of the psychological test report. (Our information did 
not include whether there was separate billing for the tests.) 
Because some questions had not been fully covered, the in- 
surance company returned the whole application, including 
all the reports. For some reason, they returned it to the pa- 
tient instead of to the hospital. The attending physician re- 
ported that the material was more than the patient could 
tolerate at that time and resulted in a relapse. He also re- 
ported that in another patient the results could have had a 
permanent, more drastic effect. 

23. Special problems are those faced with disclosure via sub- 
poena and court disclosure. Many cases are reported of in- 
dividuals, involved in court procedures, having legitimate 
claims, e.g. after accidents; needing to secure compensation 
because of losses and medical costs; having severe emo- 
tional reactions after the event; and being told by their at- 

57 



452 



Task Force Report 9 

torney the psychiatrist could be subpoened to testify, refused 
to consult anyone for the help they needed. This has been 
reported both by attorneys and physicians. 

24. A variation of this is the patient already in treatment who 
gets into court action. A number have had to forego just set- 
tlement rather than chance testimony in court about their 
disclosures to their psychiatrists. 

25. These fears are not without foundation. In one case, a psy- 
chiatrist was forced to testify in detail about the patient's 
marital problems at a deposition. Being a deposition and 
understanding it had no relevance to the issue, but being 
made to testify anyhow, he went into the details when spe- 
cifically questioned. He heard later from the patient that 
every detail was read out in open court in the presence of 
the spouse. The patient won the suit but had a destroyed 
marriage. 

26. In another, the demand was to give the full record on a child. 
To do so would have disclosed to the child in court that his 
real father had committed suicide, a fact he never knew. He 
refused to testify. We have no information on what basis he 
was able to avoid doing so. 

27. In another case the psychiatrist answered some questions. 
When he refused to answer some that he thought would do 
irreparable harm to the patient, he was held in contempt of 
court. His appeals went all the way to the State Supreme 
Court without relief. Appeals to the Federal Courts have as 
yet not brought relief. 

28. In California, welfare patients are limited to two visits a 
month to a psychiatrist. If a case requires more treatment 
than that, a Treatment Authorization Request (TAR), is re- 
quired giving in detail, the clinical facts to substantiate how 
sick the patient really is. Someone photocopied a number of 
these TARs to demonstrate how easily the information can 
be obtained. They were sent to me anonymously, so I have no 
way of knowing their source. The postmark was from South- 
ern California. The typing and form was so varied, I can only 
assume they came from a central file. Some were of children 
telling of their various criminal activity. One told of the child 
witnessing one parent killing the other. Some contained infor- 
mation of sexual activity. The obvious facts are that only 
those who are very sick would require TARs in the first place. 
Secondly, in order to get the authorization, all the severe 
pathological details have to be included (reports indicate how 

58 



453 



CONFIDENTIALITY AND THIRD PARTIES 

in some obvious severe cases, requests are refused). The next 
obvious fact is that these written records are not secure. 
There is no evidence that these records are ever destroyed. 
Once Cahfornia starts computerizing these records with a 
state wide interlocking system, access to such records can 
be done more easily, without leaving a trace. 
In a report of the World Medical Association Congress meet- 
ing in Munich, Germany, October 1974, it was reported that 
such countries as Denmark and Belgium are already using all 
such information by all government agencies. The New York 
Times carried similar information from Sweden. The Ameri- 
can Psychiatric Association, anticipating this problem, form- 
ulated a Position Paper in 1970, warning, and suggesting pro- 
tective steps be written into any National Health Insurance 
legislation. 

29. There has been a report that one state, computerizing its 
psychiatric records, used convicted inmates of its penitentiar- 
ies to transfer the crude, raw data to punch cards; making 
identifiable material available to those doing the work. The 
last report is that the project was finished. 

June 15, 1974. 



Special Note 

Readers may also be interested in Psychiatry and Confidentiality, 
An Annotated Bibliography, prepared by the Library Staff of the 
American Psychiatric Museum Association, 1700 18th Street N.W., 
Washington, D.C., 20009, September, 1974. Mimeo, 51 pages, $2.50. 



59 



454 

Dr. Beigler. I thank you again for the opportunity and privilege 
of making this presentation before your subcommittee, and thereby 
being allowed to participate in our vigourous democratic process. If 
I can be of further service, I am pleased to remain available. 

Mr. Drinan. Thank you, Dr. Beigler, for your statement. 

Dr. Beigler, what is your opinion on the consent for release of 
records through the insurance industry? 

Dr. Beigler. We had to make a compromise as far as our provi- 
sions for informed consent of release of records through the insur- 
ance industry. The political balance was such there \vas no room 
for negotiations, so we had to compromise that particular issue. 
Hopefully, there might be Federal legislation to neutralize that 
problem or perhaps in the future mandatory legislation. Otherwise, 
we find it satisfactory with perhaps a couple technical problems on 
which we ourselves will hopefully initiate corrective legislation. 

Mr. Drinan. On the collaboration with the law enforcement 
agencies which you mentioned here, I wonder if you would com- 
ment on this. All of the bills proposed at the Federal level permit 
disclosure of medical information to the Secret Service. It says in 
the administration bill that "the Secret Service may ask the hospi- 
tal or other individuals and, if the Secret Service simply states that 
they need this information, the disclosure is authorized." 

Would you comment on that particular provision? 

Dr. Beigler. Our Illinois law provides access by the Secret Serv- 
ice only as far as State hospital institutions are concerned, and 
then the information is limited to the specific stipulation, such as 
name, age, cause, duration of hospitalization, rather than disclo- 
sure of irrelevant clinical material. Those are the provisos of the 
Illinois law. 

I am well aware of the importance of having access in these 
situations. We would just have to wait and see what our experience 
is in the State of Illinois. We would recommend that the prejudice 
be in the direction of Illinois law rather than indiscriminate access. 

Mr. Drinan. Would you react to what was proposed by people on 
the panel here before; namely, that a uniform State law be adopted 
by the 50 jurisdictions? 

Dr. Beigler. I have had occasion to reflect on that problem. I 
have asked my legal scholar friends about this problem. They 
pointed out to me that, again as in most of these situations, there 
are two countervailing rights. 

On the one hand the simplicity of having a uniform Federal 
legislation has certain advantages that are obvious. On the other 
hand they point out to me that there is such a thing as creativity 
that might be stifled should there be a uniform Federal law, and 
that leaning in the direction of asking for individual laws for each 
of the 50 States might stimulate the creativity of the people at this 
level of government. 

In my own uninformed way, I do not see any reason why there 
cannot be a combination both of license for individual State laws 
and a Federal law as a guide. 

During the deliberations of the new evidence code for the Feder- 
al courts, there was a proposed rule 504 that provided for psychia- 
trist-patient privilege. We supported that proposed rule on the 
basis that it would set the standard for Federal courts and that 



455 

this would infiltrate down to the various States' Federal courts, 
and eventually would affect the shaping of State legislation. It 
seemed to me that had some advantages to it. That is what I would 
have in mind. 

As far as privilege law over the country is concerned, I believe 
there are only 10 or 12 States that have any privilege law or 
psychiatrist privilege laws. In the other States, as I understand it, 
almost any information can be obtained almost at will. Therefore, 
from that point of view a Federal standard would be helpful. 

Mr. Drinan. The gentleman from Ohio, Mr. Kindness, is recog- 
nized. 

Mr. Kindness. Thank you, Mr. Chairman. 

Thank you. Doctor. I really benefited greatly by your testimony 
here this morning. 

On a personal experience level, have you found occasion very 
often in your practice to discuss with patients the content of their 
medical records or psychiatric records or to give them complete 
access to that record? 

Dr. Beigler. In my own practice so far it has not been necessary. 
No patient has asked. I believe that is because of the nature of the 
relationship. Most of what transpires between me and my patients 
is out in the open. 

When it comes to insurance claims practices or insurance appli- 
cations, then I do not fill those things out without direct consulta- 
tion with the patient and showing the patient exactly what I have 
put down with his cooperation and approval. 

Mr. Kindness. In the area of patient access, I would think there 
would be considerable variation in terms of the degree of responsi- 
bility or ability to cope with the information contained in the 
records that you maintain for your patients. Would you care to 
comment in this area as to the dangers to the treatment process 
that might evolve from that? 

Dr. Beigler. Yes, gladly. 

During the deliberations of the Illinois law this point came up 
very early. The Illinois Psychiatric Society strongly supported the 
position of allowing access or providing for access by the patient. In 
most instances — I would say in over 99 percent of the cases — where 
there is a working relationship between the psychiatrist and the 
patient, and the patient wants to have access to the record, except 
for those personal notes where third parties have given informa- 
tion in confidence, then it would help the treatment process for the 
doctor to sit down and go over the chart with the patient. That 
would be part of the working relationship. 

We supported strongly the provisos in the Illinois law for access 
by the patient. 

There was one particular and somewhat amusing incident which 
was one of the first cases that came up in a State hospital where a 
patient wanted access to her records. Evidently she was under the 
stimulus of a civil libertarian legal advocate who thought the pa- 
tient's rights should be protected. They went through a rather 
elaborate procedure to have the patient have access to her records. 

When in the conference room this record was brought to her 
with her lawyer and some of the representatives from the hospital, 



456 

the patient took the record, tore it up, and threw it up in the air. 
That is an extreme example of the other end. 

However, in most instances I would say that it would be helpful 
to the therapeutic process in a working relationship with an intelli- 
gent or competent patient to go over the record in a helpful way. 

Mr. Kindness. If there were a provision for patient access on a 
fairly unlimited basis, would that tend to have an effect upon your 
practice as to what you would include in the records maintained? 

Dr. Beigler. Certainly. Again, it is a complex situation. There 
are multiple rights involved here. 

Some years ago I took considerable pride, because of my training 
and my sense of responsibility to train future physicians, to make a 
complete record, a rather extensive one, so that working in a 
teaching hospital there would be available to students, residents, 
and other doctors cases for clinical conferences and that sort of 
thing. One of my first hospitalized patients was covered by hospital 
insurance. Therefore, I wrote up one of these well-documented case 
histories in the process of an insurance claim and included the 
childhood history, the background of how this patient got to be the 
way he is, hopefully with the idea of educating people in the 
insurance processing office. I was naive at the time. 

The claim was rejected on the basis that because I had put in 
that this dated back to childhhod and included some of the forma- 
tive problems that led to the adult problem, the insurance compa- 
ny declared, therefore, this condition had existed before the insur- 
ance was taken out and disallowed the claim. Since that time, I do 
not write as extensive a clinical history. 

If I know the patients are going to have access, then I would 
have to be more circumspect about the things that I write, and yet 
have also in mind that there might be legal considerations so that I 
need to have adequate records as far as future responsibilities are 
concerned. 

It is a complex thing, but the trend would be to lessen the 
amount of information that is put into the record. 

Mr. Kindness. With an accompanying, presumed detriment to 
the treatment process possibly and the teaching process? 

Dr. Beigler. I think teaching, yes, and therefore quality of train- 
ing would be affected. However, I do not know what the specifics of 
that would be. 

We still convey what goes on verbally. We do have our memories 
and that sort of thing. 

Mr. Kindness. Do you see any merit to the thought that there 
would be a possibility of establishing two levels of confidentiality in 
different types of records? Would it be at all practical that there 
would be maintained a basic sort of record to which access might 
properly be obtained in the manner we are talking about? The 
other type of record, like the personal notes, would just not be 
available. It would not be subject to legal process or disclosure to 
any third party. 

Dr. Beigler. That is stipulated in the Illinois law. We have only 
had 3 months of experience with it, but so far we have had no 
reason to regret it. In fact, we think this will be a step forward 
because there is an attempt made to draw the line to allow for 
access, reasonable access, by third parties and patients to the 



457 

record, as is required for constructive purposes. Yet, at the same 
time, the personal notes provisions allow for the maintenance of 
this. For example, personally I would like to keep my own thinking 
process and my speculations that would really be out of context in 
the chart available to the patient or to an insurance company. 

For my own research purposes and writing and teaching, I have 
to have somewhat detailed notes concerning certain patients. It is a 
scientific resource. 

If that material were discoverable, I believe it would be highly 
counterproductive in the long run to the interests of society. 

Mr. Kindness. There is a part of your work and any professional 
work, I would think, that is yours and not the patient's. 

Dr. Beigler. Yes, I would think so, because again that patient is 
benefiting from the knowledge gained from previous patients. 
There is sort of an implicit responsibility to future patients as far 
as that material being used for research purposes if it is protected 
as far as privacy is concerned. 

Mr. Kindness. Thank you. 

Mr. Drinan. The gentleman from New York, Mr. Weiss, is recog- 
nized. 

Mr. Weiss. Thank you very much, Mr. Chairman. 

Dr. Beigler, I am not sure if you have worked this out totally. I 
certainly have not on the basis of your testimony, and perhaps I 
am even less certain now of the conflict than before. You seem to 
be suggesting at the outset of your testimony that in fact you have 
no problem at all with full patient access to records. Then in 
response to a later question by Mr. Kindness, I think you are 
suggesting that in fact there ought to be something like a dual set 
of records. I wonder if you recognize that conflict. Have you had 
occasion to discuss that with any of your patients or with any of 
the legislative people in Illinois to see what the general attitude 
seems to be toward that kind of really not full access, but limited 
access or dual access? 

Dr. Beigler. If I conveyed the idea that I supported complete 
access to all records by patients, then I misspoke. There are two 
exceptions in my own thinking. 

There is a small percentage of patients to whom it would be 
counterproductive to have access to records because there are 
pieces of information given in confidence by third parties. There- 
fore, we have to make some provision. 

Mr. Weiss. I think you made that clear. 

Dr. Beigler. All right. Then there is sometimes information that 
is harmful to the patient, perhaps a diagnosis or a family history. 
Again it would be a matter of clinical judgment. 

We recommend establishing what we call the clinical interme- 
diary where the physician feels there is some problem with the 
patient having access, so that this clinical intermediary — for exam- 
ple, another doctor of the patient's choice — would go over the 
record and translate it. Either full access could be given or at least 
the doctor has established the fact that he has some reservations. 

That provision is already part of the law, the Buckley amend- 
ment, on the access to school records by students and families. 
That provision is in that law— that a clinical intermediary be 
called in where there is a question of access. 



458 

Mr. Weiss. That would be in those instances where there would 
be reason to believe that there would be direct harm to the patient 
if you were to disclose? 

Dr. Beigler. Yes. 

Mr. Weiss. OK. What about beyond that? Are there circum- 
stances beyond that? 

Dr. Beigler. The other stipulation is this. If this were a problem 
for an atomic physicist, for example, of having lay access to the 
atomic physicist's records, it would all be jargon. Obviously it 
would be the kind of language that most of us would not under- 
stand. 

A psychiatrist or a psychoanalyst uses language that sounds very 
much like English, but these are all technical terms. The legal 
profession does the same thing. Words that sound like English are 
really technical terms. There is legalese. We have "psychoanalese" 
or "psychiatrese." It would be confusing and completely off the 
mark for most patients to try to translate the language himself. 

If I have on my records my speculations about what a dream 
means or the deeper significance of some of the material that the 
patient has brought out into the open, and the patient had access 
to that, it would be very confusing at best. Yet, if I do not have an 
avenue for recording some of this information for my studies, for 
my future reflection, or for my scientific work and writing, then I 
think I have done a disservice to the patient because other patients 
might benefit from the work that I do. 

I believe there has to be some stipulation for reserving these 
personal notes. The legislators in Illinois were sympathetic and 
enacted that proviso. 

My friends with whom I have spoken, people who deal with 
families and the children's services bureaus, so far say that the 
thing works. When parents want access, they can have access to 
the factual material. Some of this confidential business or the 
speculations of the therapist and the providers is kept apart. Two 
sets of records are kept. 

Mr. Weiss. Under Illinois law does that apply only to psychiatric 
medical records or does it apply generally to other providers of 
medical services? 

Dr. Beigler. No. Only to psychiatric records. 

Suppose you have a back injury and you want access to your 
records. You get all the records. You get the lab results and the X- 
rays. The doctor goes over it with you. You are only dealing with 
hard facts, tangibles. 

However, when you are dealing with psychiatric material, it is 
intangible and subject to interpretation. You are dealing with a lot 
of intimate things. It becomes rather complex. 

It is not the same as a banking record, an insurance record, or a 
hard medical record. 

Mr. Weiss. Is the Illinois law part of a comprehensive piece of 
legislation that deals with all kinds of medical records or does it 
only deal with psychiatric medical records? 

Dr. Beigler. Psychiatric and social service records. Let's see, it is 
called Mental Health and Developmental Disabilities Confidential- 
ity Act. 



459 

Mr. Weiss. Are you then suggesting for our consideration that at 
the Federal level there also ought to be that kind of special consid- 
eration or treatment or provision for mental health records? 

Dr. Beigler. Right. 

Mr. Kindness. Might I insert a question at this point? 

With respect to disclosure to a third party, an insurance carrier 
or an employer might have to have that much information that 
identifies the diagnosis in order to support the claim. However, 
even that disclosure, if misused so as to get beyond the anticipated 
bounds of use, could be harmful to a psychiatric patient as well as 
a medical patient generally, I suppose. 

Dr. Beigler. Yes. 

Mr. Kindness. Do you have any further specific thoughts with 
respect to what ought to be the guidelines, however established — 
Federal or State, statutory or regulatory — on the use of informa- 
tion once it is disclosed by the health care provider to the initial 
user of that information for necessary purposes? 

Dr. Beigler. Would you please restate that question? 

Mr. Kindness. Yes. What sort of guidelines should that third 
party have to follow with respect to the use of that information in 
your view? 

Dr. Beigler. We have had rather extensive experience and delib- 
erations on that particular point. We feel strongly that the patient 
should have control over what is done with the information that 
applies to him. 

We happen to be in the middle of negotiations with the Depart- 
ment of Defense, CHAMPUS program for medical benefits to de- 
pendents of armed forces personnel, also currently with the PSRO's 
(Professional Standards Review Organizations). Regulations are 
currently being published which allow access by the Secretary of 
HEW to the deliberations of the Professional Standards Review 
Organizations. 

If that occurs, then there is no control over the re-release or 
redisclosure of that information to some other agency. For exam- 
ple, if HEW is allowed by regulation to have access to the delibera- 
tions of PSRO's, then there is no control over what happens to that 
information after it gets to them. It is similar with law enforce- 
ment agencies or with CHAMPUS. Once those records are released 
to the Department of Defense, for example, then there is no control 
by the patient over what happens. 

We recommend that there be no redisclosure without informing 
the patient, thereby he controls to a degree what happens to the 
information. 

One of the buzz expressions on this thing is "the privilege follows 
the paper." 

Mr. Weiss. Dr. Beigler, does Illinois have a basic medical record 
privacy act? 

Dr. Beigler. Yes. 

Mr. Weiss. It does? I assume that preceded by some time the 
most recent mental health privacy act? 

Dr. Beigler. Yes. 

Mr. Weiss. How long, do you know? How long has that basic law 
been in effect? 

Dr. Beigler. Ten or fifteen years. I don't know. 



56-421 O - 80 — 30 



460 

Mr. Weiss. At the time that the mental health privacy records 
legislation was adopted, what was the reaction of the general medi- 
cal community? 

Dr. Beigler. To the new 

Mr. Weiss. To the new legislation. 

Dr. Beigler. They helped us have it passed. We have a close 
relationship with the medical society. Our people worked together 
to get this law passed. 

Mr. Weiss. There seems to be a broad recognition throughout the 
medical community as well as the political community at large, the 
legislative community, that there was the occasion after the years 
of experience with the basic law for a special treatment for mental 
health. Is that right? 

Dr. Beigler. Yes. The Illinois medical privilege law is very simi- 
lar to other State laws. It has 15 exceptions to privilege. It works 
only if there is no litigation. 

Mr. Weiss. Thank you very much. 

Mr. Drinan. I know counsel has questions. We are pressed for 
time and I want the members to hear Dr. Cordis. Counsel, do you 
have one or two questions or would you like to present them in 
writing later? You may proceed briefly. 

Mr. Cellman. Let me ask questions on one series of topics. The 
APA model law permits a 12-year-old to inspect his medical rec- 
ords. Are all 12-year-olds mature enough to handle this responsibil- 
ity? 

Mr. Drinan. Yes, in Illinois they are. [Laughter.] 

Dr. Beigler. Did you know that in the Federal regulations, re- 
garding the use of human subjects for research, the age of consent 
is 7? 

Mr. Cellman. No, I did not. 

Dr. Beigler. Originally in Illinois we advised an age of 16. Then 
the child psychiatrists and the child workers protested, feeling that 
age 12 was a more reasonable age. 

Mr. Cellman. The problem is not so much with the child having 
access to his records, but with his being able to keep his parents 
from seeing his records. I would think, in a lot of cases with 12- 
year-olds, the parents would get very upset at being excluded. 

Dr. Beigler. That is true. Yet, again it is a matter of balance. It 
is in the child's interest in some situations where they do have the 
right to have access to certain types of medical treatment without 
permission from their parents. 

It would be incongruous not to allow them to have privacy of 
their own records. Again it is a matter of all of us becoming 
educated to the problem. Times are different now than they used to 
be. It is difficult and subtle as to where to draw the balance. 

Mr. Cellman. What would you think of a proposal that provided 
for children between, say, 12 and 16, just to pick numbers out of 
the air, for children within those ages the doctor would have the 
right to make the decision whether they were mature enough to 
see their records or whether their parents should do it. 

Dr. Beigler. I would have to think that one over, Mr. Cellman. 

In the APA model law these are only guidelines and it is up to 
the local jurisdictions as to what the legislative realities are and 
what is the mood of that particular group who knows the specifics 



461 

of a given situation. It is only a guideline. We do not have any 
hard, dedicated position on the number. 

Mr. Gellman. Thank you. 

Mr. Drinan. Thank you very much, Dr. Beigler. I commend you 
upon being so well informed and so devoted to privacy in this area. 

The next witness is Dr. Leon Cordis, a professor of epidemiology 
at Johns Hopkins University School of Hygiene and Public Health. 

Dr. Gordis, we have your statement. It will be made a part of the 
record. Please proceed in anyway that you think appropriate. 

STATEMENT OF DR. LEON GORDIS, REPRESENTING THE SOCI- 
ETY FOR EPIDEMIOLOGIC RESEARCH, AND THE ASSOCI- 
ATION OF AMERICAN MEDICAL COLLEGES 

Dr. Gordis. Thank you very much, Mr. Chairman. 

I think the most appropriate way to proceed is not to read the 
full statement at this hour. 

Mr. Drinan. Thank you very much for your patience in waiting. 

Dr. Cordis. It is my pleasure. 

I would really like to concentrate on what may be some of the 
major issues. I assume that the members have had a chance or will 
have a chance to read the statement. 

Mr. Drinan. As I said, the statement in its entirety will be made 
part of the record. 

Dr. Cordis. I do appreciate the opportunity to testify. I will try 
to keep my comments brief to allow enough time for questions, if 
the members have any. 

By way of introduction, I would like to mention briefly why I am 
here. I have been engaged in epidemiologic and population-based 
research now for over a decade. For 5 years I served on the Institu- 
tional Review Board of the School of Hygiene and Public Health at 
Johns Hopkins University. When I went off that board, I went on 
the Institutional Review Board of the Johns Hopkins School of 
Medicine and Hospitals, on which I am now. 

I know that a good deal of the interest of the committee relates 
to the institutional review boards. I have had considerable experi- 
ence over the past several years in that regard. 

I was invited to speak here on behalf of the Society for Epidemi- 
ologic Research, which is the official organization of those engaged 
in epidemiologic research throughout this country. It has over 
1,200 members. I have chaired its standing committee on privacy 
protection for the past several years. I am now present-elect of the 
society. 

I have also been asked by the Association of American Medical 
Colleges to speak on their behalf on the same issue. The AAMC is 
the national voice of the 119 operational U.S. medical schools in 
this country and their students and more than 400 major teaching 
hospitals in the United States. 

In the short period of time which is available I would like to 
describe for you very briefly how epidemiological research works. 
What are the requirements of such research? How can they be 
made consistent with the need for protecting the privacy and confi- 
dentiality of research subjects? 

If I get a chance, I would like to comment briefly on H.R. 2979. I 
will not comment this morning on the President's proposal because 



462 

it has only recently been received. I would like to comment on it at 
a later time. 

By way of introduction, I would like to emphasize that both 
societies that I represent this morning believe firmly in the impor- 
tance of privacy protection and that this protection can be best 
accomplished through the regulations of the Department of Health, 
Education, and Welfare which are presently in force and through 
new legislation, such as H.R. 2979 which is largely based on recom- 
mendations of the Privacy Protection Study Commission. 

I would like to take a moment to comment on what is epidemio- 
logy. It is not only a difficult word to pronounce, but I think the 
concept is a little bit difficult for many people. 

The epidemiologist looks at diseases in populations and tries to 
understand what determines the distribution of diseases in popula- 
tion. Why are certain people at higher risk for a disease than other 

people? 

The reason for doing this is that if we can identify factors in the 
environment that are associated with the disease and we can 
reduce exposure to these factors, then we have real hope for pre- 
venting disease. 

Therefore, we identify people at risk first to try to reduce envi- 
ronmental exposure. Second, if we can identify people who are at 
risk for a disease, even if we cannot prevent the disease, we can 
put them under close medical monitoring so that their disease can 
be picked up earlier and hopefully in a more treatable condition. 

This is the rationale of applying epidemiologic methods to study- 
ing diseases that are of major public health importance. Many 
public health programs in this country— on infectious disease, 
cancer, cardiovascular diseases, and many other acute and chronic 
diseases today— have involved epidemiologic research. The investi- 
gation of Legionnaire's disease alluded to earlier involved epidemi- 
ologic research. The hazards of the swine flu immunization pro- 
gram could only have been identified through epidemiologic re- 
search. 

Epidemiologic research is also used for evaluating the effective- 
ness of health care or looking at cost-benefit. If there is no benefit, 
there is no cost-benefit. Therefore, we have to demonstrate that a 
certain pattern of care or a certain method of providing care has a 
benefit to the patients who are receiving it. 

Underlying all of this is the essential fact that the use of medical 
records is very, very important in carrying out any of these types 
of studies. They are important in studying the natural history of 
disease and in studies which evaluate the quality of effectiveness of 
care. In all these studies individually identifiable information is 
essential for carrying out this research. I will come back to that in 
just a moment. 

I have listed in the written testimony on pages 6 through 8 a 
number of the major studies which have been carried out by epide- 
miologists which have made a major contribution to the health of 
the American people. For reasons of time I will not go through 
those, but they are available for your perusal later on. 

I would like to emphasize that I believe society has a vital stake 
in these studies because the dignity and privacy of patients must 



463 

be protected at the same time that we advance the basic knowledge 
required for prevention of disease in our communities. 

Epidemiologic investigations of the cause or the etiology of a 
disease, regardless of whether these studies deal with environmen- 
tal agents, new medications that have been put on the market, the 
natural history of disease, or the effectiveness of preventive and 
therapeutic intervention, all require that with proper safeguards 
medical records with individually identifiable information be made 

available. 

Why is that? How does an epidemiologist go about and do his 
work? Specifically, if an epidemiologist suspects, for example, that 
a certain occupation may be hazardous, then he has to be able to 
identify specific individuals who are in that occupational group. If 
he wants to investigate a certain group of people who have a 
disease to see whether they have a certain characteristic or a 
certain history of exposure, then he would have to identify people 
who have that disease. 

Now identifying people is generally done through the medical 
record. He needs to know who those people are. If he does not have 
the identifiers, he cannot identify who those people are with the 

That is the first reason the identifier is necessary— to actually 
tell him who are the people he should be studying who have the 
disease in question. 

Second, once he identifies these people— let's assume he identi- 
fies an occupational group— and he wants to know later on how 
many of them have died from cancer or from other diseases of how 
many of them have been hospitalized, then he must have identifi- 
able information in order to link records from various sources. The 
second reason, then, is to link records on a given individual from 
various sources, which does require identifying information. 

Finally, he needs identifying information because he usually has 
to compare the sick people he is studying with a group of normal 
people. Therefore, he needs identifying information on normal 
people so that he can understand the differences between those 
people who have a disease and those people who do not have a 
disease. 

If he does not have the identifying information, he is unable to 
evaluate new approaches for prevention, detection, and treatment. 

The identifier is critical. To have only the information in the 
record without identifiers is not sufficient. 

The second point I would like to make deals with the issue of 
patient consent for use of medical records. This was an issue ad- 
dressed earlier this morning. 

There are a number of reasons why the requirement for patient 
consent before a legitimate investigator utilizes a medical record 
would make most medical research or epidemiologic research im- 
possible. Very briefly, they are as follows: 

First of all, many of these studies are carried out years after the 
patient was hospitalized. For example, take the case of girls who 
have developed cancer of the vagina after their mothers were 
exposed to diethylstilbestrol, DES, during pregnancy. These are 
girls in adolescence; 15 or 20 years after the exposure of their 
mothers, they have developed a very serious form of cancer. 



464 

Obviously at the time their mothers were admitted to the hospi- 
tal the study could not even have been conceived. It would have 
been impossible to ask for consent. Therefore, the state of the art 
generally does not permit us to even conceive of a certain study at 
the time the patient is there even if we wanted to do so. That is the 
first problem. 

The second problem is that we often do not know if a specific 
patient will, in fact, be included in the study. We must review the 
record and validate the diagnosis before we know if that is a 
patient who has a certain disease in question. If you asked the 
patient first, it would be a "catch-22" situation: You do not know if 
you need to ask that patient because you are not sure he has the 
disease in question, and yet you cannot look to see if it is the 
disease in question because you have not obtained the patient's 
consent. 

Third, requiring prior patient consent would introduce the bias 
that if the patient said, "No, I don't want to be studied," you would 
not be able to determine whether there is a certain selection that 
has operated, so that the conclusions reached from a study might 
not be valid. I will get back to that if we have a chance. 

On pages 11 through 16, I have outlined in a bit more detail 
some of the specific kinds of studies that would be very, very 
difficult or impossible to carry out were any of these restrictions in 
force. For reasons of time I will not discuss them, but they deal 
with problems of maternal and child health, with occupational 
diseases such as occupational cancers. 

For example, we know that workers exposed to vinyl chloride are 
at a higher risk for liver cancer. Again, this could only have been 
found out by obtaining the records on a complete group of people 
exposed to vinyl chloride and a group of people not exposed, and 
comparing the rates of liver cancer in the two groups of people. 

If we were not able to do this with identifiers— and without 
requiring each employee to give consent for use of his record it 
would be impossible to derive a meaningful conclusion about this 
type of cancer. 

There are many problems today facing our society which require 
the use of epidemiologic research. I have addressed them briefly on 
pages 16 and 17. 

However, I would like to comment on one specific problem. That 
is the effects of radiation. I think this is very much in the news. 

I would like to direct your attention for a moment to the prob- 
lem of the nuclear reactor accident in Pennsylvania. Here we have 
a group of people who have been exposed to some level of radiation. 
The question is: What is the hazard to which they have been 
subjected in terms of subsequent disease? 

How do we go about answering that question? One way is to ask 
radiation scientists, physicians, and epidemiologists what they can 
tell us about the effects of low-level radiation. The fact of the 
matter is that we know that high levels of radiation are extremely 
hazardous, such as in people exposed to atomic bombs or other 
types of exposure. These people are at high risk. 

What we do not know is what is the real hazard to people 
exposed to low levels of radiation. How do we get such informa- 
tion? We would have to study a group of people who had been 



465 

exposed to low levels of radiation and compare their subsequent 
risk with the group of people who had not been exposed to such 
levels. In order to do that you would have to have records on these 
people. You would have to know their names. You would have to 
obtain their hospital records. You would have to obtain death 
certificates if they had died and compare the rates of death and 
disease in both groups of people. 

Several attempts are in progress right now to study the people 
who have been exposed to the nuclear bomb tests of many years 
ago and also to study workers in nuclear shipyards. The Depart- 
ment of Energy is now supporting such a study. 

These studies are now in progress, they do require access to 
records without patient consent and the retention of identifiers 
during the time the study is being pursued. 

Let's just suppose that 20 years from now — hopefully not — but 
let's say 20 years from now — another nuclear accident occurs. We 
would say we ought to be able to know what the hazard is because 
in 1979 there was an accident in Pennsylvania. How will we know 
what the risk has been to the people exposed to the nuclear reactor 
in Pennsylvania? Twenty years from now how will we have that 
information? 

It seems to me that the only way such information will be 
available is by having a complete census of people who have been 
exposed to that reactor and a comparable group of people not so 
exposed and obtaining detailed medical information on them for 
the next decade or two to see whether there are any hazards in 
terms of congenital malfunctions, cancer, and other problems. 

It seems to me that society has a tremendous stake in under- 
standing the public health implications and the medical implica- 
tions of this exposure, how serious it is or is not, but we will not 
have that information 20 years from now unless we make these 
records available for study. 

Mr. Drinan. If the Federal Government decided to make this 
survey you are suggesting of 50,000 people in Harrisburg, what 
State or Federal laws would inhibit such a study at this time? 

Dr. GoRDis. I do not think it would be really inhibited at this 
time. I was really saying this in support of the legislation that 
Congressman Preyer has introduced. 

We do have a model for this. The Center for Disease Control does 
investigate infectious disease outbreaks. These are usually acute 
and short term. 

The problem is — and I think this is in response to one of the 
issues that has been raised — that many of the hospitals are quite 
confused about what they are allowed to release and what they are 
not allowed to release in terms of information. They do need some 
general guidelines because there is a great deal of lack of clarity. 
This is what we encounter doing such research. 

I do not know Pennsylvania law per se. I do not know that there 
is any prohibition. 

Mr. Drinan. You stated on page 19 that this study, if it is going 
to be successful, should have "unhindered access to medical records 
including identifying information." Would that be available now? 

Dr. Cordis. In general, yes, by legitimate investigators. That is 
right. 



466 

Mr. Drinan. Thank you very much. Please proceed. 

Dr. GoRDis. I would like to comment very briefly on what goes on 
right now in terms of protecting confidentiality through the usual 
resources that we have. 

I think all the members of the committee are aware that every 
institution that receives Federal funds has an institutional review 
board which must pass on all research that is carried out in that 
institution. These boards are responsible for protecting the rights 
of human subjects. Each investigator must submit a proposal 
through that board prior to the time that the application is funded. 
If money does come from a Federal source and that has not been 
approved by the board, then those funds are not made available to 
the investigator. 

He must justify the rationale for subjecting any human research 
subject to any risk, including invasion of privacy, and must demon- 
strate to the members of the board what specific measures he is 
taking to insure the confidentiality of all personal and medical 
data in his possession. The board requires that the investigator 
show how he is protecting privacy of the medical records — the 
mechanics of how he is protecting the privacy, how the identifying 
information is going to be effectively separated from personal infor- 
mation about the subject during the research, at what point in the 
research, and how long the identifiers will be retained and for 
what reason, as well as what kind of security measures will be 
instituted. 

The board reviews the consent statement that the patient makes. 
People who are receiving medical care are regularly assured that 
their care will not be jeopardized should they choose not to cooper- 
ate. 

If there are further questions on the board, I can get into that 
later on. 

I would like to comment specifically for a moment on the bill 
itself. We have reviewed it and find that the bill has many excel- 
lent provisions in it. I would like to just emphasize one example. 
This deals with the issue of redisclosure of information from one 
legitimate investigator to another. This is part of the bill. I would 
like to emphasize its importance. 

I think that those who have drawn up the bill should be com- 
mended in its enlightened approach to the use of identifiers, to the 
nonrequirement of prior consent, and also on the re-release and 
disclosure. I would like to tell you why it is important. 

For example, many communities have established cancer regis- 
tries in recent years, which are full listings of cancer patients in a 
given community. One of the reasons for establishing a cancer 
registry is that if you have a group of patients with a certain 
cancer, they could be studied in order to try to define what the 
cause of the disease may be. That requires that the registry be able 
to re-release that information to a legitimate investigator, a bona 
fide investigator. If the registry could not do that, then most of the 
value of the registry would be lost. Re-release is crucial to most of 
the value of cancer registries in the United States today. 

I would like to give you a second example of a less formalized 
structure. I have cited it on page 22 of my statement. 



467 

A large-scale study of births in the Province of Ontario, Canada, 
was carried out some years ago. A faculty member of our depart- 
ment was given access, through proper channels and with proper 
safeguards of confidentiality, and she investigated the relationship 
of maternal smoking to the health of the infant. A great many new 
and important findings came out of this study. They were not in 
the original study. They were not the original investigative intent. 
The original investigator was addressing a different issue. 

However, the availability of this excellent data source for an- 
other investigator, after appropriate checks on privacy and confi- 
dentiality, made these data yield a new host of information regard- 
ing the impact in this case of smoking on the health of a newborn. 

There are two points that I commented on regarding the bill 
which I would like to bring to your attention. One is the grouping 
together on page 25 of researchers, auditors, and evaluators in the 
first paragraph. I would like to point out that because the research- 
ers are currently monitored by institutional review boards while 
auditors and evaluators are not, it was our view that it might not 
be advisable to group the three together because the needs are 
different for the three. Therefore, we have respectfully suggested 
what may not be proper prose, on page 23 of the testimony, a kind 
of paragraph that seemed to us to be appropriate for the research 
needs. 

I would like to comment on one more issue. That relates to the 
protection of research data from subpena. When we go out to 
interview a subject, we assure the subject that we will protect the 
privacy and confidentiality of what he gives us, the information he 
gives us. We adhere to that. We are very conscientious and scrupu- 
lous about it. 

However, the fact of the matter is that we are not protected from 
subpena. You have heard a good deal about that this morning. 

I would like to raise the issue again of whether research data 
should have specific protections from subpena except under ex- 
treme circumstances which militate otherwise. 

In summary, I do think there is need for clarification of the 
situation of privacy in regard to hospitals and medical care provid- 
ers. I think the contents of the legislation on a whole are excellent. 
I have mentioned some minor problems that I see. I believe that it 
is essential for there to be unhindered access to medical records for 
legitimate research. There should be no requirement of patient 
consent for record use provided there are safeguards for confiden- 
tiality. Identifiers must be available for investigators for reasons 
that I stated. Re-release to proper investigators should be permit- 
ted, provided that there are proper safeguards. There should be 
protection from subpena. 

Finally, I would like to commend the committee for emphasizing 
the use of the institutional review board for enforcing privacy 
standards. We believe that institutional review boards have been 
extremely effective, and one of the easiest ways of extending any 
regulations that are necessary is to strengthen them and use them 
for enforcement. 

Thank you. 

Mr. Drinan. Thank you very much. Doctor, for your excellent 
statement. 



468 

I am happy to recognize the gentleman from New York, Mr. 

Weiss. 

Mr. Weiss. I sense that even in your presentation and your 
advocacy of unhampered access that you do recognize the potential 
for abuse in this situation and that you really agree with the 
efforts that we make to try to reduce that kind of abuse which is 
possible in large-scale research efforts. 

Are you satisfied that the institutional review boards really pro- 
vide adequate safeguards along those lines? 

Dr. GoRDis. I could only comment on the basis of my own person- 
al experience both at my institution and at others where I visited 
for grant approvals or other reasons. 

My experience has been very strongly in the affirmative. Obvi- 
ously there are value judgments involved. These are difficult issues 
with which we are struggling. 

Speaking from the experience of our own institutional review 
board, they grapple very diligently with each proposal that has any 
type of risk, including invasion of privacy. If the board has any 
question, the proposal reviewed is either sent back to the investiga- 
tor or the investigator is invited to meet with the board to justify 
and give a rationale for what he is proposing to do. Very often he 
will be told that the safeguards for privacy and confidentiality are 
not sufficient that he is employing. He will be asked to rewrite his 
proposal putting in these safeguards. 

My experience is that the efforts of the members of this board 
are extremely diligent and conscientious. The fact is they often 
differ from one another, but through creative discussion they pro- 
tect the rights of the subject. 

Mr. Weiss. Would it not be both possible and preferable to set 
forth what you would consider to be adequate safeguards within 
the statute itself rather than leaving it up to the differing interpre- 
tations of the various institutional review boards? 

Dr. Cordis. The Society for Epidemiologic Research is actually 
facing this issue of setting up safeguards within departrnents of 
epidemiology for the protection of confidentiality and privacy of 
subjects. 

For example, we maintain all personal data in a locked file, but 
who will have access to the file? This is spelled out right now by 
the investigator to our committee, but we would like to get a 
general model regulation for departments that are carrying out 
this type of research. This could apply to agencies as well. 

Let me give you a specific example. On an interview form that 
comes in, the patient's name is not put on the front page of the 
form but on an extra sheet. That sheet is removed from the inter- 
view. Only a study number links the two. The sheet with the 
patient's name is locked up. All work in analyzing interview data, 
unless it is absolutely necessary, is carried out using the study 
number. If somebody walks in, the information is completely im- 
personal. 

Yet in the final analysis when it is necessary to link records 
from a given source, then the identifiers are still available. 

Mr. Weiss. What you are saying is somewhat in line with some 
of the earlier testimony today from the American Medical Record 
Association. 



469 

You really do not need the names in many of these instances. 
Numerical identifiers would do just as well. 

Dr. GoRDis. No. I would take very strong issue with the Ameri- 
can Medical Record Association. With all due respect to the wit- 
ness this morning, I suspect that her experience in carrying out 
population-based research is somewhat minimal and limited to the 
providing of records. 

Those of us who carry out this research know, as I said earlier in 
my testimony, that it is essential for various reasons to have the 
identifier. First, it is important in order to know who the patients 
are. Second, it is important to be able to link records from different 
sources. These are the two major reasons for having the identifiers. 

Operationally, while the project is carried out, we try to put the 
identifiers away under lock and key, but the principal investigator 
has access to them and frequent recourse to them. We protect the 
confidentiality of the record. 

The studies themselves could not be carried out if the investiga- 
tor carrying out the study did not have specific identifying infor- 
mation during the time the study is carried out. Results are report- 
ed only in aggregate. Identifiers are not retained after the study is 
done any longer than necessary, but during the time the study is 
carried out it is critical that the identifiers be available. 

Mr. Weiss. Yet we had a recent horror story, of which I am sure 
you are aware, in New York. That confidentiality of the record- 
keeping was handled in such a slipshod manner that information 
was broadcast as to people who had received abortions. 

Dr. GoRDis. Yes. 

Mr. Weiss. So our concern— and I think yours and everybody 
else's — is very well taken and essential in this situation because 
unless we have fairly strict implementation, we are asking for a lot 
of trouble. 

Dr. Cordis. I agree with you completely. The New York situation 
was an extremely unfortunate one. 

I might say, though, that to the best of my knowledge, despite 
the millions and millions of dollars going into medical and epidemi- 
ologic research in this country today, that is the only overt breach 
of which I am aware. You asked for recitation of horror studies. 
That does not justify that instance, but society essentially has to 
have a cost-benefit assessment of regulations it is going to imple- 
ment, too. There are various ways of doing it. 

To put a complete prohibition on identifiers is throwing out the 
baby with the bath. I think we have to look at why that happened 
and see what safeguards can be built in, but not make it so prohibi- 
tive that research cannot be carried out, even reasonable research 
that is in the best interest of society. We are trying to reach a 
balance on this. 

Mr. Weiss. Thank you, Mr. Chairman. 

Mr. Drinan. The gentleman from Ohio, Mr. Kindness, is recog- 
nized. 

Mr. Kindness. Thank you, Mr. Chairman. 

In the interest of time I will state my problem and ask for your 
comment on it. My problem is with respect to a latter comment in 
your testimony about the protection of research data from subpena. 
It does seem to me that in most instances the research data would 



470 

be second- or third-hand hearsay at best, thus would presumably 
not have a value to be used in court as evidence but might be used 
in the way of a fishing expedition in the discovery process before 

trial. 

Would you comment on that, please? 

Dr. Cordis. Not being a lawyer, I really cannot respond to that. 
It may very well be so. 

Mr. Kindness. I guess what I am really asking is this: Is it a real 
problem? 

Dr. Cordis. It is a real problem. There are specific protections 
now, I believe, for information in the area of drug abuse but that is 
limited. If a person would relate a criminal act, for example, in the 
course of an interview, as far as I know there is no protection. 

To what extent it is a serious problem I really do not know. 
However, as I say, it is a problem in the drug abuse area sufficient 
that I understand there is a Federal protection for drug abuse data. 
I do not know if that is the only area, but that is the only one I 
know of where there is a specific protection. It must have been 
enough of a problem to militate a specific protection against sub- 
pena there. How extensive this problem is I really cannot say, but I 
did want to bring it to the attention of the committee. 

Mr. Kindness. Thank you. 

Mr. Drinan. Thank you very much, Dr. Cordis. We thank you 
for your testimony. We thank you also for your patience. 

We would talk longer here, but the bells are ringing to summon 
us to other duties. 

[Correspondence follows:] 



471 
THE JOHNS HOPKINS UNIVERSITY 

SCHOOL OF HYGIENE AND PUBLIC HEALTH 

DEPARTMENT OF EPIDEMIOLOGY 615 North Wolfc Street • Baltimore, Maryland 21205 

Telephone fJOlJ 955-3286 

May 30, 1979 



Congressman Richardson Preyer 

Chairman 

Government Information and Individual 

Rights Subcommittee of the 

Committee on Government Operations 
Congress of the United States 
House of Representatives 
Washington, D.C. 20515 

Dear Congressman Preyer: 

My apologies for the delay in rny responding to your kind 
letter of April 16th. 

In regard to the specific question you raise requesting documenta- 
tion of the fact that certain institutions are concerned about possible 
liability for non-consensual disclosures of identifiable medical records, 
the problem has been that in our experience, when institutions have such 
a concern, they generally do not voice such concerns in writing but 
rather just refuse permission. However, our personal contacts with 
hospital administrations and medical records room personnel have indicated 
to us verbally, that the basis for the hospital's refusal is often such 
a concern. 

Recently however, in connection with a study being carried out 
in our department, we received a letter from one of the Baltimore hospitals 
we approached asking to review medical records. I believe the short 
excerpt I will present will demonstrate to you that concerns about 
liability are in fact, quite real. The letter, addressed to one of our 
faculty and signed by the Vice President for Medical Affairs of this 
hospital, read in part as follows: 

"I am responding to your letter of April 27th, 1979 
requesting permission to review the medical records 

at ^hospital as part of the research study. 

At the advice of the hospital attorneys we have adopted 
the following protocol in regard to this type of 
request. 



472 



Before ^hospital releases such infonnation 

to any outside researcher, the researcher must sign 
an agreement that in consideration of permission to 
review and to use patient records maintained by 



hospital, the researcher agrees to maintain the confi- 
dentiality of any patients identified and to use the 
records only for research purposes specified in its 
request for access to the records. Furthermore, the 
researcher and his sponsor should agree to 

indemnify hospital against any claims 

made by any patient as a result of such release." 

On another issue I should also like to point out that, as I 
stated in my testimony, the use of medical records is often the only 
starting point for identifying patients with a disease or a comparison 
group without a disease and contacting them and with their informed 
consent, obtaining further information through interview or questionnaire. 
I believe that it will be important for any legislation to clearly state 
that with the hospital's approval, it is legitimate for an investigator 
using medical records to contact the subject (or next of kin of the 
subject) identified through those records and ask for their participation 
in further studies. I believe that an explicit statement of this would 
be extremely valuable and important. 



Sincarely, 




LeBn Gorbis, MiD. 
Professor and Chairman 
LG/bb 

Mr. Drinan. The subcommittee stands adjourned. 
[Dr. Cordis' prepared statement follows:] 



473 



RES EARCH USING MEDICAL RECORDS: ITS IMPORTANCE 
TO THE HEALTH OF THE AMERICAN PEOPLE 



STATEMENT PRESENTED TO 

THE GOVERNMENT INFORMATION AND INDIVIDUAL RIGHTS SUBCOMMITTEE 

OF THE COMMITTEE ON GOVERNMENT OPERATIONS 

OF THE U.S. HOUSE OF REPRESENTATIVES 



April 9, 1979 

by 
Leon Gordis, M.D., Dr. P.H. 
on behalf of the 



Society for Epidemiologic Research 

and the 

Association of* American Medical Colleges 



♦Address: Department of Epidemiology 

Johns Hopkins University School of Hygiene & Public Health 
615 N. Wolfe St. 
Baltimore, Md. 21205 

Telephone: 301-955-3286 



474 



1. INTRODUCTION 



It is an honor and privilege for me to appear before this 
subcommittee in connection with its consideration of H.R. 2979, the 
Federal Privacy of Medical Records Act. 

First, I would like to say a few words about my own professional 
background to help explain to the Committee my qualifications for testi- 
fying this morning. I am a Professor of Epidemiology and Chairman of 
the Department of Epidemiology at The Johns Hopkins University School of 
Hygiene and Public Health. I also hold a joint appointment in the 
Department of Pediatrics in The Johns Hopkins School of Medicine. I 
have a Medical Degree and Masters and Doctorate Degrees in Public Health. 
I am a board-certified pediatrician and a member of a number of profes- 
sional societies including the American Pediatric Society, the Society 
for Pediatric Research, the American Epidemiologic Society and the 
Society for Epidemiology Research. I have been actively engaged in 
epidemiologic and pediatric research for more than a decade. In addition, 
for five years, I served as a member of the Committee on Human Volunteers 
of The Johns Hopkins University School of Hygiene and Public Health, and 
am now a member of the Joint Committee on Clinical Investigation which 
is the Institutional Review Board of the Johns Hopkins School of Medicine 
and the Johns Hopkins Hospital. In accordance with the guidelines of 
the Department of Health, Education and Welfare which are currently in 
force, this committee is charged with protecting the rights of human 
research subjects and guaranteeing the confidentiality of all personal 
and medical data obtained in the course of any research investigation. 



475 



This morning I am testifying in a dual capacity. First as a 
member and representative of the Society for Epidemiologic Research. 
This society is the official organization of "those engaged in epidemio- 
logic research throughout this country and has over 1200 members. I am 
presently President-Elect of the Society and serve as Chairman of its 
Standing Committee on Protection of Privacy in Epidemiologic Research. 

In addition to representing the Society for Epidemiologic 
Research this morning, I am also here as spokesman for the Association 
of American Medical Colleges (AAMC) formed in 1876 to work for reform in 
medical colleges. It has broadened its activity over the years so that 
today it represents the whole complex of individuals, organizations and 
institutions charged with the undergraduate and graduate education of 
physicians. It serves as a national voice for all of the 119 opera- 
tional U.S. medical schools and their students, more than 400 of the 
major teaching hospitals, and 60 learned academic societies whose 
members are engaged in medical education, biomedical research and the 
delivery of health care. Through its members, the concerns of the 
Association range far beyond medical education itself and include the 
total health and well-being of the American people. 

In the time allotted me this morning I should like to do 
several things: First, I should like to describe yery briefly the scope 
of epidemiologic research and its importance for the health and well- 
being of the American people. Second, I should like to demonstrate how 
essential the use of medical records has been in the past in a number of 
landmark epidemiologic studies which have made invaluable contributions 
to the health of our citizens. Third, I should like to indicate some 



476 



of the Important health problems we now face which desperately need 
knowledge gained from epidemiologic research if these problems are to be 
prevented and controlled, and how essential the use of medical records 
is for carrying out the studies needed in these areas. Fourth, I should 
like to describe to you briefly the safeguards which are currently in 
effect for protecting the rights of human research subjects and the 
confidentiality of their personal information, including that in medical 
records, during the course of a research project. Finally, I would like 
to comment specifically on H.R. 2979, The Federal Privacy of Medical 
Records Act. Since the President's message to Congress on Privacy 
Policy, including a draft of the proposed "Privacy of Medical Information 
Act", has only recently been received, I shall not discuss it this 
morning, but would like to submit specific comments on it at a later date. 

I should like to emphasize that the members of the Society for 
Epidemiologic Research and of the Association of American Medical Colleges 
are fully committed to protecting the confidentiality of the medical and 
personal data they obtain in the course their research activities and 
share a deep concern for the protection of all people who participate in 
medical and epidemiologic research. We believe that privacy protection 
can best be accomplished through the Department of Health, Education and 
Welfare regulations presently in force and through new legislation such 
as H.R. 2979 which is largely based on the recommendations made by the 
Privacy Protection Study Commission in its report to the Congress 
entitled, "Personal Privacy in an Information Society". 



477 



2. Epidemiology and the Nation's Hea1th--The Need for Using Medical Records 

Epidemiology may be defined as the study of the distribution 
and dynamics of disease in human populations. Its purpose is to iden- 
tify specific agents or factors related to people and their environments 
which may be the cause of disease or which may identify people who are 
at high risk for developing a disease. In so doing, epidemiology pro- 
vides the basis for public health programs designed to prevent and 
control disease. Prevention can be effected by reducing or eliminating 
people's exposure to a specific factor, once its importance in producing 
disease has been demonstrated. Identification of people at high risk 
for disease is important for two main reasons: First, so that measures 
can be adopted to prevent their developing disease and second, to provide 
medical supervision and screening tests where appropriate so that if 
they do develop disease, their illness can be identified at a very early 
stage when it can be successfully treated. 

The public health programs made possible by knowledge gained 
from epidemiologic investigations include those directed at prevention 
and control of infectious diseases, and of cancer, stroke, heart and 
other cardiovascular diseases, and many other acute and chronic con- 
ditions which affect the American people. Investigation of "Legionnaire's 
Disease", for example, required an epidemiologic approach. Epidemiologic 
methods are also essential for evaluating the efficacy of new preventive 
and therapeutic measures as well as their possible harmful side effects. 
For example, the possible harmful effects of swine flu immunization 
required epidemiologic investigation and indeed, these investigations 



478 



were responsibile for demonstrating the relationship between immunization 
and development of the Guillain-Barre syndrome. 

Epidemiologic methods are also needed for determining the 
effectiveness of new organizational patterns for delivering health care. 
In addition, those of us who are concerned with the question of cost- 
benefit in health care recognize that the issue cannot be reasonably 
discussed by focusing only on cost. For in examining cost-benefit of 
any type of health care, one must first demonstrate that it, in fact, 
has a benefit, and such a demonstration requires the use of epidemiologic 
methods. 

In this context, I should like to direct this Committee's 
attention to the invaluable contribution of medical and vital records to 
various types of health-related research. These records are used in 
epidemiologic investigations, in longitudinal studies of the natural 
history of disease, and in studies whi?h are designed to evaluate the 
quality and effectiveness of health care delivered to the community. In 
addition, I should like to stress that individually identifiable informa- 
tion in medical records is essential for conducting epidemiologic studies. 
It is necessary so that the records can be used as the basis for identi- 
fying individuals with a certain disease and individuals without the 
disease--some of whom may have had their disease many years prior to the 
time of the study— so that these individuals can be followed up through 
interviews, questionnaires or other methods. Individually identifiable 
information is also necessary in order to link records from different 
sources which pertain to a given individual. Thus, for example, in 



479 



investigating whether a new form of treatment improves survivorship, it 
is necessary to link hospital records with death certificates for each 
individual receiving the new treatment and for each individual not 
receiving the new treatment so that the death rates in both groups can 
be compared. 

3. Some Major Health Studies Which Have Required Use of Medical Records 

Epidemiologic inquiry depends on the availability of the 

medical and vital records of large numbers of people, both for the data 

/ 
that they contain as well as for ascertaining and identify'ing individuals for 

subsequent interview and study. The major contributions of epidemiology 

to our understanding of disease have been based on studies using data 

from such sources, studies sometimes conducted many years after the 

information was recorded. These contributions can be demonstrated by a 

few selected examples of past investigations which have elucidated the 

causes of human diseases and facilitated their prevention. Many would 

have been virtually impossible to carry out had medical and other 

records which included identifying information, not been available to 

investigators. Among these studies are: 

1 . Cancer 

Studies which demonstrated: 

- the relationship of cigarette smoking to lung cancer 

as well as to coronary heart disease, bladder cancer 

and other conditions. 



480 



- an increased cancer risk associated with occupational 
exposure to substances such as asbestos, vinyl chloride 
and arsenic. 

- the increased risk of several types of cancer after 
exposure to radiation. 

- that the daughters of women who received the hormone 
diethyl stilbestrol (DES) during pregnancy have an 
increased risk of developing cancer of the vagina 
many years later. 

- that women taking estrogens for menopausal symptoms 
are at increased risk of endometrial or uterine cancer. 

- the effectiveness of breast cancer screening in reducing 
mortality from breast cancer. 

2. Cardiovascular Diseases 

Studies which demonstrated: 

- that high blood fats, high blood pressure and smoking 
shorten life expectancy, particularly through early death 
from coronary heart disease. 

- that women taking oral contraceptives are at increased 
risk of developing thromboembolism or stroke. 

- the benefit of early detection and treatment of 
hypertension. 

- that administration of anticoagulants to patients with 
myocardial infarctions is associated with lower post- 
infarction mortality rates. 



481 



3. Infectious Diseases 
Studies which: • 

- led to the development of vaccines for poliomyelitis, 
measles and other infectious diseases. 

- showed that cases of polio which developed subsequent 
to polio immunization in 1955 resulted from a vaccine lot 
having been contaminated with live virus. 

4. Health of Children 

Studies which demonstrated: 

- that the administration of high concentrations of 
oxygen to premature infants results in blindness. 

- that maternal rubella (German measles) infection 
during pregnancy produced congenital malformations 

in the infant. 

- that the use of thalidomide during pregnancy results 
in severe congenital malformations of the arms and legs 

of infants. 

- that maternal radiation exposure during pregnancy is 
associated with an increased risk of childhood cancer and 
congenital malformations. 

- that Rh disease (erythroblastosis fetalis) in newborns 

can be prevented. 

- that inner-city comprehensive care programs for children 
and youth are effective in reducing rates of rheumatic fever. 

These are but a handful of the important studies which have 
produced direct benefits for human health by identifying the causes of 
disease, facilitating the development of preventive methods, and evaluating 



482 



new ways of providing medical care and organizing health care delivery. 
It would be tragic indeed if the potential benefits to society of such 
research were lost as a result of any restrictive approach which in 
essence would make such studies impossible. 

Society has a vital stake in these types of studies. Society 
as well as the affected individuals must bear the costs of disease. 
Consequently, society must ensure that a reasonable approach will pre- 
vail, in which the dignity and privacy of patients will be protected 
while the advancement of knowledge of disease through epidemiologic 
investigation will be facilitated. The social contract which facilitates 
the existence of communities as social groups, requires that each indi- 
vidual yield some of his individual rights, including confidentiality 
and freedom of action, for the benefits of society as a whole. Com- 
pliance with traffic regulations and with income tax laws are but two 
examples of the interactive workings of the social contract. Each 
society must decide when a limited compromising of individual rights is 
justified by the potential benefits to be derived by the community as a 
whole. Epidemiologic investigations of the etiology of a disease-- 
whether dealing with environmental agents, newly developed medications, 
the natural history of a disease, or the effectiveness of preventive and 
therapeutic interventions--are of great potential benefit to society and 
its members. The conduct of such studies, however, requires that, with 
proper safeguards, individually identifiable data from medical and other 
records be made accessible for purposes of legitimate medical and epidemio- 
logic research without requiring prior patient consent. 



483 

4. How Epidemiologic Investigations Are Carried Out Using Medical 
and Other Records 

a. Why Identifying Information is Essential For Such Research 
In order to carry out epidemiologic research it is often 
necessary to identify individuals with specific diseases or disabilities, 
or individuals who share some common environmental exposure. Medical 
records are essential for identifying populations with specific diseases 
and for obtaining detailed historical, clinical and laboratory informa- 
tion about the patients. Individually identifiable information is 
essential in these studies, because access to these records is only a 
first step in ascertaining and identifying patients with the particular 
disease under study so that they can be subsequently contacted, and with, 
their informed consent, interviewed and studied. Identification of 
specific individuals during the time the research is conducted is also 
essential to link records on a given person from different sources, such 
as physician records, hospital records, employment records, and birth 
and death certificates. Furthermore, since groups of patients with a 
particular disease must be compared with groups who are non-diseased or 
who do not have the particular disease under study, in order that meaning- 
ful inferences about the causes of the disease can be derived, identifying 
information about non-diseased and non-patient subjects must also be 
available. This approach is fundamental to epidemiologic studies of the 
etiologic and risk factors of disease, to studies of the natural history 
and prognosis of disease, to the evaluation of new approaches to preven- 
tion, early detection and treatment, and to the evaluation of new methods 
for delivering health services. 



484 



b. Why Requiring Patient Consent Would Make Most Studies Impossible 
It is important to point out that such research would be vir- 
tually impossible to carry out if patient consent were required in order 
for the investigator to have access to medical records. Since the 
studies described above were frequently conducted many years after the 
original medical information was recorded, the state of knowledge at the 
time the information was obtained from the patient may not even have 
permitted the study to be conceived, so that patients' consents could 
not possibly have been obtained. In addition, reviewing medical records 
is often only the first step in ascertaining and identifying patients 
with a given disease so that they may be subsequently traced, contacted 
and with their permission, studied further. Any requirement that consent 
be obtained before any medical record is reviewed would be extremely 
destructive to medical and epidemiologic research and consequently would 
be profoundly damaging to the maintenance and improvement of the health 
of all Americans. 

5. Some Specific Examples 

a. PES and Vaginal Cancer 

In order to convey some idea of just how important the legiti- 
mate research use of medical records is, I should like to cite a few 
major findings from several epidemiologic studies. First, I should like 
to refer to the studies dealing with di ethyl stilbestrol or DES as it is 
known. These studies of the effects of DES in human beings are particu- 
larly important since for many years DES was added to livestock feeds in 
the United States. A few years ago, investigators in Boston demonstrated 



485 



through an epidemiologic study, that when mothers took DES during pregnancy 
to prevent a miscarriage, female offspring of these pregnancies were at 
Increased risk of d.eveloping a rare type of cancer of the vagina when 
they reached adolescence. 

This study could only have been carried out through the use of 
medical records. Three particular features are noteworthy here: First, 
the cancer did not appear in the person taking the medication but only 
in her female offsping exposed to DES during intrauterine life. Second, 
the cancer appeared some 15 to 20 years after exposure to DES so that it 
was necessary to go back many years to determine exposures and to 
identify the drugs taken in pregnancy. Third, in this study, the girls 
and young women who had this cancer were first identified from their 
medical records, and only then could their mothers be contacted and 
followed-up. Consequently, if use of medical records were prohibited, 
or if such use were permitted only with the consent of the patient, 
these studies which demonstrated the cancer-producing effect of DES in 
women many years after exposure, would have been impossible to carry 
out. 

This study is perhaps the first demonstration in human beings 
of transplacental carcinogenesis, i.e., that cancer-causing agents taken 
by the mother can cross the placenta and produce cancer in the offspring. 
There may be other such agents--presently unknown--which mothers should 
avoid during pregnancy because of the hazard to their children. In 
order to identify these agents, thorough epidemiologic investigations 
using medical records are needed to protect the health of American women 
and their children. This is an area which could not be explored, 
however, if restrictions were placed on research uses of medical records. 



486 



b. Occupational Cancers 

I should like to turn next to another important area--the 
health of the American worker. In recent years, there has been increasing 
recognition that Americans employed in industries are often subjected to 
high concentrations of potentially toxic substances. Thus, for example, 
workers exposed to vinyl chloride have been shown to be at high risk of 
liver cancer. This finding, which has now been confirmed in a number of 
studies, could only be made by reviewing the medical records of large 
groups of employees in specific industries and linking the employees' 
records at the factory site with hospital records and death certificates 
if they exist. Without access to these records it would be impossible 
to have identified vinyl chloride as a cause of cancer in occupationally 
exposed human beings. I should also point out in this connection, that 
if there were a requirement that patient consent be obtained before the 
records were made available--these studies could also not have been 
carried out because many patients had either died by the time the study 
was done or else had moved and could not be traced. 

It is clear that we have only begun to scratch the surface in 
terms of the toxic and cancer-producing potentials of substances to 
which American workers are exposed in the course of their daily labors. 
Any restriction which would preclude the possibility of identifying new 
damaging substances and documenting their harmful effects would be a 
major setback to the protection of the health of the American worker. 
c. Preventable Blindness in Premature Infants 

I should like to turn briefly to a tragic medical story which 
unfolded during the. 1950's. At that time premature infants who were of 



487 



low birthweight, were found to have an increased risk of a form of 
blindness called retrolental fibroplasia. Surprisingly, the risk of 
blindness was highest in the best medical centers in our country while 
in the less sophisticated and less well-equipped medical centers, the 
risk seemed lower. Initially there was no clue as to what might be 
causing this blindness and numerous investigations in many areas were 
carried out. However, epidemiologic investigations subsequently demon- 
strated that the cause of this blindness was high oxygen concentrations 
administered to the premature newborns. These high concentrations were 
often only provided in the best medical centers, since at that time, the 
highest possible oxygen concentration was considered the best medical 
care for these infants. Since that time, restriction of the oxygen 
concentration to a lower level when administered to premature infants 
has virtually wiped out this form of blindness in prematures. Again, 
these studies which demonstrated that high oxygen concentrations were 
the cause of blindness in children and that reducing these concentrations 
could prevent such blindness, would have been totally impossible to 
carry out were access to medical records restricted. 

d. Benefits of Anticoagulant Drugs For Patients with Heart 
Attacks 

For many years, there has been a difference of opinion among 

physicians with regard to the possible effects of anticoagulants in the 

treatment of patients who have heart attacks. Several years ago, we 

carried out a study in which we reviewed the records of a large number 

of patients who had had heart attacks and who had been hospitalized 



488 



some years previously. We ascertained which patients had received 
anticoagulants and which patients had not, and then determined which, ., 
patients had died during their hospitalizations. We were able to show thit 
the death rate was much lower in patients who had received anticoagulants 
during their hospitalization than in those who had not. This important 
observation has now been confirmed in another study carried out in our 
Department. We believe that in the coming years, these findings will 
have major implications for the care of heart attack victims. Yet 
both. studies could not have been carried out without the use of medical 
records and identifying information, and would have been impossible had 
the consent of the patient been required for reviewing these records. 
e. Harmful Effects of the Pill (Oral Contraceptives) 
Although the "pill" has been demonstrated to be a highly 
effective and convenient form of birth control which has been adopted 
by many American women as their form of contraception, a large number 
of epidemiologic studies have now demonstrated that women taking the pill 
for long periods of time are at increased risk for blood clots, strokes, 
heart attacks, high blood pressure, liver tumors, gallbladder disease, 
congenital malformations in their offspring and other conditions. These 
highly significant findings were in large measure the result of large- 
scale studies which used hospital and medical records--studies which again 
would have been impossible to carry out if patient consent had been 
required. The pill studies are examples of studies of the adverse 
effects of many drugs which are critical for protecting the health 
and well-being of the American public. 



489 



f. Improved Survival of Children with Leukemia 
One of the greatest accomplishments of American medicine 
during the past decade or two has been the breakthrough in the treatment 
of acute leukemia in children. While children with leukemia at one time 
died within a few months after diagnosis, with the new advances in 
therapy, they now live many years— and are often free of any evidence of 
their disease. The demonstration that new forms of therapy have re- 
sulted in an improved outcome such as this for the patient also requires 
the use of medical records. 

6. Meeting Current Challenges to the Health of the American Public-- 
The Need for Research Using Medical Records 

Among the major public health problems today in the United 

States are those of cancer, cardiovascular disease and other chronic 

conditions, as well as infectious diseases such as hepatitis, venereal 

diseases and influenza, and the evaluation of the benefits and possible 

risks of new vaccines. Much of cancer today is probably environmentally 

determined. In an interview some time ago. Dr. Arthur C. Upton, Director 

of the National Cancer Institute, responded to a question about research 

needs in the cancer field, saying, "We need a lot more good epidemiology. 

It can tell us not only about environmental factors but also about ' . 

genetic influences and we really do need to know about both." Dr. Upton's 

comments apply just as well to cardiovascular diseases, including coronary 

disease, high blood pressure and stroke, neurological diseases including 

epilepsy, as well as to diabetes, arthritis, digestive diseases and 

virtually all other chronic conditions in this country. In addition, 

the effects on human health of new drugs and other chemicals in the 

environment which require close attention, if the health of the American 



490 



public is to be protected, can only be identified through epidemiologic 
and other investigations, most of which depend on the availability of 
medical records. Any legislation which would limit the availability of 
these records and would require patient consent, would seriously compromise 
medical and epidemiologic research in this country and would make most of 
these studies impossible. The result would be serious damage to the health 
of many Americans, and certain groups in particular, such as American 
workers, women and children would be left at high risk of exposure to 
toxic, cancer-causing or malformation-causing agents, without any form 
of protection. Thus, the maintenance and improvement of the health of 
Americans and their protection from environmental hazards, requires the 
facilitation of epidemiologic research and the continued availability 
of medical records. At the same time, confidentiality and privacy must 
be protected through the means discussed below. 

7. A Specific Current Example: Effects of Radiation 

I should like to give the members of this Subcommittee a more 
immediate example of how essential epidemiologic research based on 
medical and other records is. I should like to direct your attention to 
the recent nuclear reactor accident in Pennsylvania. One of the questions 
posed by this accident has been how serious is the potential risk to resi- 
dents of the area who may be exposed to radiation from the reactor? 
We know that high levels of radiation are extremely hazardous to human 
beings by producing cancer, congenital malformations and other serious 
problems. What is not known with any degree of certainty is the extent 
of the hazard from low levels of radiation. In order to generate data 
on the hazard from such low levels of radiation it is essential that 



491 



information be collected on a population of people who had such a radiation 
exposure in the past. If such a population can be identified, we would 
then attempt to trace the members of this population and obtain any 
relevant physician records, hospital records, or death certificates. 
It would also be necessary to identify a non-exposed population and 
obtain similar records in order to determine the rate of disease in 
that population. Only in this way could we determine whether the exposed 
group has a higher rate of disease or a higher death rate than the group 
that. was not exposed. In order to answer the question whether people 
who were exposed to low levels of radiation are at greater risk than 
those who were not so exposed, we would compare the rates of disease 
and of death in the exposed people with the rates in those who were not 
exposed. Such a comparison requires that, with proper provisions for 
the protection of privacy, medical and other records for the members 
of both groups be available for investigation. For the conclusions 
to be valid, complete records must be available on the entire group 
virtually without exception. Examples of populations which were exposed 
to radiation and are currently being studied in this way are individuals 
who were exposed to fallout from atomic bomb tests in the past and 
individuals who were employed in the naval shipyards. 

Now, let us consider what might happen twenty years from now 
if another such nuclear accident occurred. We might want to know what 
were the effects--both short-term and long-term—of the 1979 Pennsylvania 
nuclear accident on people who were exposed to radiation which leaked 
from the reactor? How could this question be answered? The answer 
could come only if we were able to follow-up the total population of 
residents of the area around the reactor over a period of many years, 



56-421 C - 80 — 32 



492 



identify all episodes of serious illness and deaths in this group, and 
obtain similar information for a population that is comparable to the 
exposed population except for the fact that it was not exposed. These 
data would be extremely important in the future for assessing the serious- 
ness of exposure to levels of radiation which leaked from the Pennsylvania 
reactor. In order to obtain these data, it would be necessary to have 
the names and addresses of all residents in the area, to have access 
to their medical and vital records with identifiers included, and to 
establish procedures for tracing, re-contacting and following up these 
people to determine all episodes of serious illness and death. If 
access to records is not facilitated for legitimate medical and 
epidemiologic research, the American people will be denied such informa- 
tion regarding radiation hazards. It is, therefore, essential that any 
legislation enacted by the Congress ensure that legitimate medical and 
epidemiologic researchers have unhindered access to medical records 
including identifying information. Such access, naturally, must be 
conditional on the demonstration by the investigator to his Institutiohal 
Review Board that he has provided adequately for protection of privacy and 
confidentiality. 

8. Existing Safeguards for Protecting Confidentiality 

I should like to comment now on the safeguards which are 
currently in force for protecting confidentiality. As studies are 
conducted, all epidemiologists and medical researchers have a major 
professional and personal responsibility to minimize invasion of 
privacy as much as possible, and to protect vigorously the confidentiality 



493 



of the data in their possession. The provisions of the National 
Research Act (P.L. 93-348) and. its implementing regulations on Protection 
of Human Subjects, codify an elaborate system of safeguards, currently 
in operation within the scientific community, to prevent violations 
of the rights of patients for purposes of research. This system is 
complete with Institutional Review Boards which are responsible for 
protecting the rights of human subjects and to which each investigator must 
justify the rationale for subjecting any human research subject to any 
risk--including invasion of privacy--and must demonstrate the measures 
he is taking to ensure the confidentiality of all personal and medical 
data in his possession. 

In any study, Institutional Review Boards serve to ensure 
that unnecessary invasion of privacy will not take place and that 
.adequate safeguards will be provided for the confidential handling 
of data and that the use of individual identifying Information together 
with the data will be kept to an absolute minimum consistent with carry- 
ing out the study properly. Investigators must assure the Institutional 
Review Board that the research data that they collect will be kept 
under lock and key, and they must inform the committee who will have 
access to the data, how and at what point in the research individually 
identifiable Information will be effectively separated from other data 
and whether or not the data will be retained at the close of the study, 
and if so, why. Each Board thoroughly reviews interview instruments 
and questionnaires, the consent statement and any accompanying material 
which must be sufficiently informative to enable the subjects to decide 
on their participation freely and rationally. If the subjects are 
patients, they are regularly assured that their care will not be jeo- 
pardized in any way by their failure to participate and further, all 



494 



subjects are assured that they are free to withdraw from a study at any 
time. Many of these provisions "are spelled out in the current regula- 
tions of the Department of Health, Education and Welfare. 

It is thus apparent that epidemiologists and other medical 
investigators are keenly sensitive to the challenge of ensuring confi- 
dentiality and protecting human subjects, and as presented briefly in 
this section, already have an elaborate and effective system which pro- 
tects the subjects and the confidentiality of their personal and medical 
data, and at the same time facilitates the conduct of medical and epi- 
demiologic research so that the cause of improving the health of 
Americans will be advanced as rapidly as possible. 

9. Comments on The Proposed Legislation 

I should like now to comment specifically on Bill H.R. 2979. 

After a thorough review of this Bill, we find that most 
of its provisions which bear on research uses of medical records, are 
well considered and thought out. The Bill wisely protects access to 
records by medical and epidemiologic investigators but at the same time 
pays appropriate attention to the needs for safeguarding privacy and con- 
fidentiality. 

I should like to point out that the provisions in H.R. 2979 
which allow re-release or re-disclosure of information for research or 
health statistics purposes provided safeguards of confidentiality and 
privacy are maintained, are extremely important. Permit me to cite 
a specific example. Because of the increasing importance of the problem 
of cancer in our country, many cities and states are establishing 
cancer registries. These are lists of newly identified patients with 



495 



cancer and they are designed not only to facilitate the long-term 
care of cancer patients but also to alert health officials quickly 
to clusters of new types of cancer which may be occurring and also to 
permit investigators to identify all patients with a given cancer so 
that the cause of that cancer can be investigated. 

Cancer registries generally obtain their data from hospitals 
and pathology laboratories. Existence of a registry would be of very 
limited usefulness, however, if it were not possible for the registry 
to go the next step and make its data available to legitimate cancer 
investigators. Thus, re-release of information with appropriate safe- 
guards is essential . 

I should like to cite a second example. A large-scale 
study of births was carried out some years ago in Ontario, Canada. 
Subsequently, an investigator in our Department was able to utilize the 
data from that study to demonstrate a number of important relationships 
between a mother's smoking habits during pregnancy and the subsequent 
health status of her newborn infant. These findings were possible only 
because the data from the original study were made available some time 
later to another investigator. Throughout this process of re-release, 
rigid safeguards were maintained to protect the privacy and confidentiality 
of all data and identifying information. 

I should, however, like to raise two specific points with re- 
gards to H.R. 2979. First, the first paragraph of Page 25 (b) (1) 
groups together researchers, auditors, and evaluators of identifiable 
medical record information. We believe that this grouping is inadvisable. 
Under current regulations, researchers are, in fact, already subject to 



496 



supervision by Institutional Review Boards in regard to protection of 
human subjects and the maintenance of privacy and confidentiality of 
personal and medical records. On the other hand, auditors and evaluators 
have no such supervision and therefore, the needs for protection of 
privacy and confidentiality for them differ from the needs for protecting 
privacy and confidentiality in regard to researchers. We therefore 
believe that in that paragraph, the word "researchers" should be eliminated 
from line 2 and again from line 8. 

We respectfully propose that a paragraph along the following 
lines be inserted between lines 10 and 11 on Page 25 following paragraph 

(b) (1): 

The secretary shall require that the assurance statements 
received from Institutional Review Boards contain adequate 
security standards regarding the use and maintenance by 
researchers of identifiable medical record information dis- 
closed by facilities under Sections 124 and 125. These 
standards of the Institutional Review Boards shall include 
appropriate administrative, technical and physical safe- 
guards for ensuring the security and confidentiality of 
these records. 

I should like to make a further comment regarding another 
important issue. This relates to the protection of research data 
from subpoena. At the present time, in most research areas, no such 
protection is guaranteed. While an investigator may make the maximum 
effort to safeguard the confidentiality and privacy of information he 
obtains, such information may be subjected to subpoena by a court of law. 



497 



We therefore respectfully suggest that data obtained for research pur- 
poses be immune from subpoena except under very precisely stated extreme 
circumstances. 

10. Summary and Recommendations 

The issue of privacy and confidentiality is an important one 
which must be addressed by society. Epidemiologic and medical inves- 
tigators whose goal is the improvement of human health and the preven- 
tion and control of disease, are keenly aware of this issue and operate 
under safeguards designed to protect human subjects participating in 
research and to ensure the confidentiality of the information they 
provide--be it through questionnaires, interviews or their medical 
records. 

Continued epidemiologic and medical research is essential to 
improve the health of the American public and to protect all Americans, 
and in particular certain subgroups such as industrial and other workers, 
who are at high risk from old and new environmental hazards. Identifying 
the causes of disease in order to develop prevention programs, and 
evaluating the effectiveness of new preventive and therapeutic measures 
as well as new ways of organizing and delivering health and medical 
care, all require an epidemiologic approach which must utilize medical 
and hospital records. Access to such records must be unhampered, provided 
that the investigator provides adequate assurance to his Institutional 
Review Board, that privacy and confidentiality are being adequately 
maintained. 

[Whereupon, at 12:20 p.m., the subcommittee adjourned, to recon- 
vene at 10 a.m., Wednesday, April 11, 1979.] 



PRIVACY OF MEDICAL RECORDS 



WEDNESDAY, APRIL 11, 1979 

House of Representatives, 

Government Information 
AND Individual Rights Subcommittee 
OF the Committee on Government Operations, 

Washington, D.C. 

The subcommittee met, pursuant to recess, at 10:07 a.m., in room 
2247, Rayburn House Office Building, Hon. Richardson Preyer 
(chairman of the subcommittee) presiding. 

Present: Representatives Richardson Preyer and Peter H. Kost- 
mayer. 

Also present: Timothy Ingram, staff director; Robert Gellman, 
professional staff member; Maura Flaherty, clerk; and Thomas 
Morr, minority professional staff. Committee on Government Oper- 
ations. 

Mr. Preyer. The subcommittee will come to order. 

Today we continue our hearings on legislation to protect the 
confidentiality of medical records. Our first witness is Mr. Justice 
Horace Krever, Commissioner of the Royal Commission of Inquiry 
into the Confidentiality of Health Records in Ontario, Canada. Mr. 
Justice Krever is accompanied by Harvey Strosberg, counsel to the 
Commission. 

When this subcommittee began serious consideration of the medi- 
cal records issue last year, we discovered very quickly that the 
Canadian Royal Commission was well ahead of us. Through the 
kind cooperation of the Royal Commission's staff, we have been 
able to follow the progress of the Commission's investigations. The 
results have been very impressive, and I don't mind admitting that 
we are a bit jealous of the excellent job they are doing. No one in 
this country has compiled such a thorough record of the abuses of 
medical records. 

On behalf of the subcommittee, I welcome both of you here 
today. We are very grateful that you were able to take time out of 
your busy schedules to share with us some of the evidence that you 
have uncovered in the last year. I know that it will be of tremen- 
dous assistance to us as we consider the need for legislation in this 
country. 

It is a pleasure at this time to recognize Mr. Justice Krever and 
Mr. Strosberg. We will ask them to proceed in any manner they 
see fit. 

(499) 



500 

STATEMENT OF JUSTICE HORACE KREVER, COMMISSIONER, 
ROYAL COMMISSION OF INQUIRY INTO THE CONFIDENTIAL- 
ITY OF HEALTH RECORDS, TORONTO, ONTARIO; ACCOMPA- 
NIED BY HARVEY STROSBERG, COUNSEL 

Mr. Krever. Thank you very much, Mr. Chairman. 

May I express my pleasure at being here and demonstrate my 
gratitude for all the assistance enthusiastically given to us by your 
staff, particularly by Mr. Gellman who has been the liaison be- 
tween our staffs. I hope that cooperation which has been so evident 
will continue until we both have completed our tasks. If we can be 
of any assistance in the future, we will be only too happy to do so. 
All you need to do is ask. 

Mr. Preyer. We appreciate that. We will be calling on you. 

Mr. Krever. If it would be more helpful for someone or all of 
you and your staff to come to Toronto to see first hand what we 
have acquired by way of information, you are more than welcome. 

I want to begin with one word of qualification. Because I have 
not yet submitted my report, I am a little handicapped by the 
absence of freedom that I would have had if I had reported, in 
speaking my mind on policy matters. I will be happy to share with 
you all the factual information we have which is not in dispute. 
However, where there are disputed issues of fact, I will have to 
make findings of fact, and that is something for the future. 

May I give you a little picture of our jurisdiction? To a national 
body of your dimensions we, by comparison, are really a micro- 
cosm. When you look at the figures that we may cite to you, I 
think it would be helpful to see what those figures are with rela- 
tion to the entire population and other demographic features of 
Ontario. I know this may be insulting in a way perhaps to all of 
you, but for the record I think I should say something about our 
two different jurisdictions and the differences between them. 
Therefore, for the record I will preface my remarks with this 
explanation. 

Canada is a Federal nation with 10 Provinces. We have no consti- 
tutionally entrenched bill of rights. Although we have a Federal 
statute called the Bill of Rights Act, it has no application to those 
fileds in which the provincial legislatures are sovereign. The field 
of property and civil rights within the Province, of which privacy 
may be thought to be a part, is within the exclusive legislative 
jurisdiction of the Provinces. 

The right of privacy — and I think this is an important distinction 
you should bear in mind — is not one in respect to which as yet 
protection has been given in the sense of the sanction of a recog- 
nized cause of action for damages for the violation of one's privacy. 

Time does not permit a longer exposition of our constitutional 
distribution of legislative power. However, I think it will be enough 
for the purposes of your record to say simply that it is complicated. 

As one illustration of how complicated it is, let me say this. I 
serve on the highest court of the Province of Ontario, a court that 
is the creature of provincial legislation and therefore a creature of 
the Province because it is created by a statute enacted by the 
Legislature of Ontario. Yet I am appointed to serve during good 
behavior until I am 75. I am appointed by the Federal executive 



501 

and paid by the Federal Government. That is just one illustratin of 
how complicated the relationship between the two jurisdictions is. 

Our government, both Federal and Provincial, is the British style 
parliamentary system with a monarch — thus, the name Royal Com- 
mission — and a Cabinet whose members are responsible to the 
legislature and its members. 

Canada has a population of approximately 23 million. The Prov- 
ince of Ontario, which consists of about 10 or 11 percent of the 
country in area, has a population of approximately 8.5 million. 
Therefore, the population of Ontario is 36 percent, approximately, 
of the entire nation's population. In population, Ontario is Can- 
ada's largest Province. 

My inquiry is provincial in scope. It relates only to Ontario. My 
mandate arises out of an order in council made by the Lieutenant 
Governor in Council of Ontario. That is to say that it is an execu- 
tive order under the authority of a statute enacted by the Legisla- 
ture of the Province of Ontario called the Public Inquiries Act. The 
order in council was made on December 21, 1977, but our public 
hearings did not begin until April 19 of last year. So we are just 
about a year old with respect to the hearings we have been con- 
ducting. 

[The Executive orders follow:] 



mm 

> « ' ^ V- ^1 LU 

Oii(,iiio 



502 

O.C. ^1^^/77 



Executive Council 

Copy of an Order-in-Council approved by 
His Honour the Administrator of the Government of 
the Province of Ontario, dated the 21st day of 
December, A.D. 1977. 

The CoiTCTiittce of Counci ]. have had under 
consideration the report of the Honourable the 
Minister of Health, wherein he states that, 

WHEREAS there has been considerable 
recent public discussion respecting the confiden- 
tiality of health and associated personal information. 

The Honourable the Minister of Health 
therefore recommends that 

1. pursuant to the provisions of The Public 

Inquiries Act, 1971, S.O. 1971, Chapter 49, 
the confidentiality of health and associated 
personal information, collected under legis- 
lation administered by the Minister of Health 
and any other relevant legislation administered 
by other Ministers of the Crown, be declared 
to be a matter of public concern, and that a 
Commission be issued appointing 

THE HONOURABLE MR. JUSTICE HORACE KREVER, TORONTO 

to conduct an Inquiry v/ith the following terms 

of reference: 

1) to review all legislation administered by . 
the Minister of Health (for example. The 
Public Hospitals 7ict, The Health DiscipD.ines 



503 



Act, The Health Insurance Act and The 
Mental Act) , together with any other 
relevant legislation administered by 
other Ministers, and any Regulations 
passed thereunder, to determine whether 
proper protection is given to the rights 
of persons who ha\e received, or who may 
receive, health services, to preserve 
the confidentiality of information respect- 
ing them collected under that legislation; 

2) to reviev; the legality of the administra- 
tive processes under the above Acts; and 

3) to report thereon to the Minister of Health 
with any recommendations for necessary 
amendments to the legislation and the 
Regulations passed thereunder; 

2. All Government Ministries, boards, agencies and 
commissions be requested to assist the commission 
to the fullest extent in order that it may carry 
out its duties and functions; 

3. The commission have the power and authority to 
engage counsel, expert technical advisors, 
investigators and other staff as it deems proper 
at rates of remuneration and reimbursement to 

. be approved by the Management Board of Cabinet; 



504 



4. Part III of The Public Inquiries Act, 1971 

be declared to apply to the said Inquiry and 
to the commission. 

The Committee of Council concur in the 
recommendation of the Honourable the Minister of 
Health and advise that the same be acted on. 

Certified, 



Deputy Clerk, Executive Council. 






505 

o c ll^lZI'^ 



Execulive Council 

Copy of an Order- in-Council approved 
by Her Honour the Lieutenant Governor, dated the 
19th day of April, A. D. 1978. 



The Committee of Council have had under 
consideration the report of the Honourable the 
Minister of Health, wherein he states that, 

WHEREAS, pursuant to Order-in-Council 
numbered OC-3566/77 dated the 21st day of December, 
A.D. 1977, a Commission was issued appointing the 
Honourable Mr. Justice Horace Krever to conduct an 
Inquiry respecting confidentiality of liealth 
information; 

AND VJHEREAS questions have arisen as to the 
scope of the Inquiry, so that it is desirable that 
the terms of reference of the Commission be clarified; 

The Honourable the Minister of Health 
therefore recoimnends that 
1. the said Order-in-Council numbered OC-3566/77 

be amended by striking out the terms of reference 
set out in Paragraph No. 1 thereof and sub- 
stituting therefor the following: 
1) to review all legislation administered by 
the Minister of Health (for example. The 
Public Hospitals Act, The Health Disciplines 
Act, 1974, The Health Insurance Act, 1972 



506 



and The Mental ll'^alth Act), tocjether with 
any other relevant legislation administered 
by other Ministers, and any Regulations 
passed thereunder, to determine whetlicr 
. proper protection is given to the rights 
of persons who liave received, or who may 
receive, health services, to preserve the 
confidentiality of information respecting 
them collected under that legislation; 

2) to review the legality of the administrative 
processes under the above Acts; 

3) to investigate, inquire into and consider 
any misconduct, and any negligent or ot'ner 
improper activities, practices or conduct 
by any person, firm, corporation or 
organization in relation to the above Acts 
and Regulations and the administration 
thereof, including any non-compliance by 

any person, firm, corporation or organization 
with any of the above Acts and Regulations, 
and any activities, practices or other conduct 
by any person, firm, corporation or 
organization which coerced, induced, persuaded 
or otherwise pronipted any such misconduct, 
negligence or other improper activity, practice 
or conduct, or wliich constituted an attempt or 



507 



an agreement Ld coerce, induce, persuade or 
otherwise prompt any sucli misconduct, neglicjonce 
or other improper activity, practice or conduct; 
and 

4) to report thereon to the Minister of Health 
with any recommendations for necessary 
amendments to the legislation and tlie 
Regulations passed thereunder. 

• * 

The Committee of Council concur in the 
recon\mendation of the Honourable the Minister of 
Health and advise that the same be acted on. 

Certified, 



Deputy Clerk, Executive Council 



-.ay por 



56-421 O - 80 — 33 



508 

Mr. Krever. The origin of our inquiry is not easy to explain, but 
I think it is safe to say that it began with stories in the press about 
instances in which confidential health information had been given 
by persons obliged to keep the information confidential. The stories 
in the press led to questions in the legislature. When the answers 
to those questions were eventually forthcoming, they caused con- 
cern to be expressed by members of all parties in the legislature. 
Thus, the Cabinet decided to create an inquiry because it deemed 
the issue involved to be one of public concern. 

At the time of the creation of the inquiry it was not known by 
those involved, either in asking the questions or in answering 
them, what the extent of the violations of confidentiality that 
occurred truly was. Indeed, it is probably fair to say that the area 
in which the greatest number of violations occured, which is in the 
private casualty insurance sector, was not known by anyone. We 
came upon it, and perhaps the largest segment of our hearings was 
devoted to the practices in that area. 

Although this is a gratuitous statement, I suspect that those 
practices occurred not only in Ontario but throughout North Amer- 
ica because many, if not most, of the insurance carriers are related 
or in some cases subsidiaries of U.S. insurance companies. 

We have a fair amount of information, Mr. Chairman. Rather 
than presume to know what would help you most, with that open- 
ing I will now sit back and await your questions. 

Mr. Preyer. All right. Thank you, Mr. Justice Krever. 

To bring out some of the facts which you have developed, we 
might ask a few general questions. Some of your most spectacular 
evidence related to the acquisition of medical records by private 
investigators through pretext calls. Could you describe for us how 
this practice was uncovered and how these investigators were able 
to obtain records through pretext calls? 

Mr. Krever. It was uncovered initially by a very summary and 
initial survey of the public hospitals in Ontario. The survey was 
concerned principally with the extent to which, if at all, police 
forces throughout the Province had attempted to obtain informa- 
tion from hospitals. The boards of hospitals are obliged to keep the 
information confidential and not produce it for the police except 
pursuant to subpena. 

In one small hospital in a small community near Niagara Falls 
there was a note kept by a medical record technician about a 
telephone call she had received. The note was simply a phone 
number. I will summarize this but I think it is accurate enough for 
our purposes here today. She said she had been called by a woman 
purporting to be a nurse in a large hospital in Toronto. The caller 
said that they had in the emergency department a woman who was 
very ill, that they knew the woman had been treated in the St. 
Catherine's Hospital, and they had to know how she had been 
treated. 

The medical record technician was bright enough— or perhaps 
suspicious enough— to say, "Well, I will call you back." She called 
for the file and then she looked up the phone number. She saw 
that the phone number she had did not match the phone number 
of the Toronto hospital. 



509 

She called back, and the name of that hospital was the Toronto 
General Hospital. There is also a Toronto East General Hospital. 
When the woman said this is not the Toronto General Hospital, the 
caller said, "Oh, I said Toronto East General Hospital." She then 
looked that number up and saw that it was not the number of that 
hospital either. 

While she was engaged in this discussion, another telephone call 
was received in her office from a man purporting to be a physician 
in the emergency department, angry because this information was 
not forthcoming. He was unsuccessful. 

With that phone number that she retained, we were able to 
locate a private investigation firm in Toronto. They had changed 
their phone number shortly after this incident, but we were able to 
get their identity by going back in the record. With that informa- 
tion Mr. Strosberg was able to interview one employee. That com- 
pany in fact hired registered nurses, qualified registered nurses, to 
make these pretext calls. As a result of the information obtained 
from her, we had enough information to justify applying for a 
search warrant. 

A search warrant was issued. We obtained files which disclosed 
that they were doing this on a rather wholesale basis. They were 
reporting to their clients who were insurance companies. 

On the basis of that information we were able to get search 
warrants to obtain the records of those insurance companies. Those 
insurance companies then told us about other investigative reports 
they received from other private investigators. We then went to 
those private investigators whose files revealed other insurance 
companies. It went on in that fashion. That is how we obtained it. 

The methods used by them varied. The pretexts varied. Some- 
times they pretended to be a health-care worker. Sometimes they 
pretended to be conducting a neutral kind of survey, such as a 
shopping survey or accident survey. That would cause the respond- 
ent to open up and give information which would be used by the 
insurer against whom that individual might be making a claim. 

Mr. Preyer. Did your investigation show that the pretext calls 
by private investigators were a widespread practice? Or was it a 
practice of just one isolated private investigator? 

Mr. Krever. It was very widespread. Mr. Strosberg could prob- 
ably give you some statistics he was able to put together for the 
purpose of this attendance. 

Mr. Strosberg. We attempted to obtain specimen copies of inves- 
tigative reports that were in possession of the insurance adjusters 
and insurance companies. We set up a rather simplified computer 
program. We did not attempt to obtain every report. We were