The Honorable Patrick J. Leahy
Washington, DC 20510
Dear Senator Leahy:
The American Association for Clinical Chemistry (AACC), representing nearly 11,000 clinical laboratory professionals, supports your efforts, as outlined in S.573, the "Medical Information Privacy and Security Act," to protect individuals from discrimination on the basis of their medical data. We agree that identifiable health information must remain confidential, unless the patient authorizes its release. However, AACC does have a number of concerns regarding the legislation. Our specific comments follow:
Section 3(7) Purposes
This section states that "To invoke the sweep of congressional powers…to prevent unauthorized use of protected health information that is genetic information." We recommend that you end the sentence after "protected health information" and delete "this is genetic information." Otherwise, this narrow Purpose conflicts with the broader definition of protected health information in Section 4(17).
Sections 101(a)(1) Right of Individual; 101(a)(2) Procedures and Fees; & 101(b) Deadline
S.573 states that individuals have the right to inspect and copy their own ‘protected’ health information, as long as they agree to pay for the costs associated with inspecting and copying the document. The bill also states that the provider has 15 days to comply with this request. AACC recommends that the entity have 30 days to comply with the request and 60 days if the information is stored offsite or not readily available.
Sections 102(b) Refusal to Supplement & 102(c) Statement of Disagreement
The legislation would also permit individuals to request that health care providers add supplemental data, provided by the individual, to their medical records. If the provider denies the request, the individual could file a statement with the provider disputing the decision. In any subsequent disclosure of the disputed information, the provider would be required to include a copy of the patient’s statement and, if requested, the provider’s reasoning for not adding the supplemental information to the medical record. AACC recommends that the applicability of this section be more narrowly defined.
We agree that patients who perceive errors in their medical records should be able to request and obtain a correction to their records. However, we believe this provision needs to be more narrowly defined with regard to laboratories and other health care providers who create and report objective measurements.
Laboratories produce analytical results, they do not make diagnoses, or provide treatment—these are the responsibilities of the physician. We believe laboratories should, upon request, review all analytical testing and testing processes to ensure the accuracy of the test. However, it is impractical and inappropriate for the laboratory to serve as the repository and distributor of supplemental information.
Currently, many laboratories transfer such data to microfilm or magnetic tape once the patient transaction is completed. Permitting patients to add supplemental information to their laboratory records would require the establishment of a separate, parallel filing system. This would be both impractical and costly for laboratories, while not improving the confidentiality of patient results.
More important, without the patient’s complete medical record, the laboratory is unable to confirm whether a patient’s request is valid or not. The only person who can make that determination is the treating physician. Therefore, AACC recommends that with regards to healthcare providers, the supplemental data option be limited to the treating physician, whether in private practice or the hospital, who is the primary recipient of such inquiries and who can best determine whether the patient’s request is valid. We offer the following language as a possible option for addressing this issue:
Sec. 102 (a)(4) RESULTS OF ANALYTICAL DIAGNOSTIC TESTS. When individuals make a request to add supplemental data to their protected health information, which consists of one or more results of laboratory tests or pathological evaluation of body fluids or tissues, the individual making the request shall provide the basis upon which he or she believes the supplemental information is necessary. Upon receipt of such a request, the entity that created the protected health information shall review all analytical and/or testing processes that produced the result(s) in question, and shall provide the results of this review in writing to the individual making the request. If any inaccuracy is detected, the entity that created the protected health information shall make corrections consistent with its review and shall provide an amended report to the subject of the test and to the subject’s treating physician(s). In the event that no inaccuracy is detected upon review, the subject of the request shall not have the right to submit a statement of disagreement as provided in subsection (c) below.
Section 112(a) Accounting for Disclosures
S.573 states that "a health care provider, health plan, health oversight agency…shall establish and maintain with respect to any protected health information disclosure that is not related to payment or treatment, a record of the disclosure in accordance with regulations issued by the Secretary in consultation with the Director of the Office of Health Information Privacy." AACC agrees that health care providers and other entities should not be required to record the disclosure of protected health information for payment and treatment reasons.
Sections 112(b) Accounting for Disclosures & 202(g) Record of Individual’s Authorizations and Revocations
These sections stipulate that each person collecting or storing personally identifiable health information shall maintain a record for a period of seven years of each authorization and revocation, and that such data will become part of the person’s identifiable health information. Because laboratories are subject to regulations that require keeping different records for different lengths of time, we recommend that you change these provisions to make them consistent with other regulations.
For example, the Medicare conditions of participation for hospitals requires that laboratories keep records for five years, whereas the Clinical Laboratory Improvement Amendments requires keeping some records up to ten years. We suggest that the following provision replace existing language in Sections 112(b) and 202(g): "Where existing regulations require that records be kept for a specific length of time, the record of disclosure [or authorization] is required to be kept for the length of time stated in the applicable regulation."
Sections 201(j)(2) Definitions-Segregate & 202(e) Segregation of Files
S.573 states that segregate "means to place a designated subset of an individuals protected health information in a location or computer file that is separate from the location or computer file used to store protected health information and where access to or use of any information so segregated may be effectively limited to those persons who are authorized by the individual to access or use such information." The bill also states that, at the request of an individual, the health care provider must "segregate any type or amount of protected health information, other than administrative billing information, held by the entity."
Although AACC agrees there should be restrictions on who, or what entities should have access to a patient’s medical information, we do not believe that protected health information should be separated from the patient’s chart. Most medical data are now in electronic format. To segregate protected data separately will be costly, place an additional administrative burden on providers and will not provide the patient greater privacy.
In fact, a notation on the patient’s file indicating the existence of segregated data may be as damaging to the patient as the protected information itself. More important, segregating these data from the patient’s record increases the risk that such data may be excluded from important medical decisions. We recommend that S.573 be modified to place the emphasis on increased penalties for the negligent or intentional disclosure of protected information, rather than segregating the data.
Section 202 (a) (1) & (a)(5) Authorizations for Disclosure of Protected Health Information for Treatment and Payment: Providers
This section states that "every health care provider providing health care to an individual who has not given an authorization under this section shall, at the time of providing such care, obtain a signed, written authorization…" AACC recommends that this provision be more narrowly written.
Laboratories and other ancillary health care providers frequently do not interact with the patient and therefore have no way of verifying whether the patient has provided the appropriate signature. Moreover, in such circumstances the laboratory has no opportunity to obtain the required authorization. Indeed, many state laws, as well as the Clinical Laboratory Improvement Amendments of 1988 and the Medicare Conditions of Participation, require laboratories to provide the results of testing to the ordering physician, without regard for prior authorization. Thus, we recommend that the following language be added: "health care providers may presume that authorization has been obtained if a patient has health insurance, including Medicare, or has received a service order from another health care provider."
Section 204(b) Emergency Circumstances
Section 204 section states that "in the event of a threat of imminent physical or mental harm to the subject of the protected health information, any person may, in order to allay or remedy such threat, disclose protected health information about such subject to a health care practitioner, health care facility, law enforcement authority or emergency medical personnel." AACC strongly supports this flexibility. We believe it is essential that health care providers be able to focus their attention on helping the patient and not have to worry about possible legal ramifications for doing so.
Section 301 Establishment
This section would establish an Office of Health Information within the Department of Health and Human Services to carry out the activities specified under this legislation. AACC does not agree with this recommendation. A new government office is not necessary to implement the provisions set forth under this bill. If enacted, AACC urges you to use the existing regulatory framework to coordinate program activities.
AACC agrees with the principles underlying this proposal, namely that patients should have greater access to their medical records and how and to whom that information is disclosed. We believe this can be accomplished without significantly increasing the costs or regulatory burden of laboratories and other health care providers. Thus, we urge you to adopt these modest changes, thereby narrowing the scope of this legislation and making it feasible to implement.
By way of background, AACC is the principal association of professional laboratory scientists--including MDs, PhDs and medical technologists. AACC’s members develop and use chemical concepts, procedures, techniques and instrumentation in health-related investigations and work in hospitals, independent laboratories and the diagnostics industry nationwide. The AACC's objectives are to further the public interest and educational activities and to help maintain high professional standards.
If you have any questions or we may be of any assistance, please call me at (405) 271-3571 or Vince Stine, Director, Government Affairs, at (202) 835-8721.
K. Michael Parker, PhD