U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attention: Privacy-P, Room G-322A
Hubert H. Humphrey Building
200 Independence Avenue, SW
Washington, DC 20201
The American Association for Clinical Chemistry (AACC), representing nearly 11,000 professional laboratory scientists, welcomes the opportunity to comment on the Department of Health and Human Services' (HHS') November 3, 1999 proposed rule, which establishes new standards of privacy for individually identifiable health information. In general, we support your efforts to expand patient control over medical data, maintain the integrity of health care research and minimize the administrative burdens on health care entities. We hope that our comments, which follow, will assist you in this endeavor.
164.504 Definitions: Health Care Operations
The proposed medical privacy rule states that a covered entity can disclose protected health information without authorization if the information is to be used for treatment, payment or health operations. Otherwise, a health provider or plan must obtain patient authorization to release the data, unless one of the specified exceptions is met. We are concerned that the current definition of health care operations does not reference clinical studies performed by laboratories to demonstrate the quality of patient test results. These studies could not be performed without access to patient records.
The Clinical Laboratory Improvement Amendments of 1988 (CLIA'88) requires laboratories to establish and verify the performance specifications of each test method prior to reporting patient results. This quality control procedure allows the laboratory to assure the physician of the accuracy of the test result that he or she will use to diagnose the patient. To comply with this standard, laboratories conduct clinical studies on each test method by routinely reviewing patient medical records for data, such as: age, sex, race and diagnosis, etc. This information is critical to correlating the test result to the diagnosis, as well as identifying any demographic variations.
AACC recommends that you insert that following language under the health operations definition:
" (6) Conducting such studies and inquiries as would be necessary to perform initial laboratory test quality validations and to monitor ongoing laboratory test performance as required under CLIA'88."
We believe this change will correct the problem.
164.508 Uses and disclosures for which individual authorization is required
This section states that providers do not need to obtain patient authorization for releasing protected health information, if such information is being used for treatment, payment or related health operations. AACC supports this provision.
164.510 (j) Uses and disclosures for research purposes
The proposed rule establishes safeguards for both protecting patient medical data and ensuring access to such data for research purposes. Researchers may obtain protected health information if they have approval from an institutional review board or an appropriately designed privacy board and have an adequate plan in place to protect the data. AACC believes these oversight requirements are responsible and feasible.
164.510 (k) Uses and disclosures in emergency circumstances
The Department proposes that health care providers and plans be permitted to disclose protected health care information if there is "a reasonable belief that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public." AACC strongly supports this flexibility. We believe it is essential that health care providers be able to focus their attention on helping the patient and not have to worry about possible legal ramifications for doing so.
164.514 (a) & (d) Access of individuals to protected health information
The proposal states that an individual has the right to inspect and copy his or her own protected health information, as long as he or she agrees to pay the costs associated with inspecting and copying the document. The bill also states that the provider has 30 days to comply with this request. AACC believes these are reasonable recommendations. However, we do recommend that providers and plans be permitted 60 days to comply with an information request, if the records are stored off premises or are not readily available.
164.516 (a) & (b) & (c)4 Amendment and Correction
The proposed rule states that "an individual has the right to request a covered entity that is a health plan or health care provider to amend or correct protected health information about him or her…for as long as the covered entity maintains the information." Further, if the provider denies the request, the individual could file a statement with the entity disputing the decision. In any subsequent disclosure of the disputed information, the provider would be required to include a copy of the patient's statement and, if requested, the provider's reason for not adding the supplemental information to the medical record. AACC recommends that the applicability of this section be more narrowly defined.
We agree that patients who perceive errors in their medical records should be able to request and obtain a correction to their records. However, we believe HHS should make a distinction between the "initiating provider" and other health care entities. This proposal fails to recognize that there are significant differences between primary and ancillary healthcare providers. For example, the private practice physician or hospital (for inpatient care) interacts with the patient and has access to the complete medical record or information about the episode of care. Laboratories and other secondary providers do not. Thus, we believe it is appropriate that the provider initiating treatment (e.g. physician, hospital, and skilled nursing facility), who is responsible for a patient's care, also be the main source for obtaining medical data, and for making decisions regarding any changes to the patient's medical record.
164.516 (c)(3)(iii)(A) Amendment and Correction
This section states that a provider or health plan, after amending the patient's record, must make reasonable efforts to inform any person to whom the unamended portion of the information was previously disclosed. AACC recommends that this provision be modified so that the provider has the discretion, based on the medical relevancy of the information, to determine whether the "amended" section of the patient record should be sent to the individuals who previously received the protected health information.
164.520 (f) Documentation of Policies and Procedures: Implementation Specification
HHS would require providers and health plans to maintain the documents specified in this section for at least six years. AACC recommends that you change this provision to five years to make it consistent with the Medicare conditions of participation for hospitals. HHS should strive for consistency in its requirements, wherever possible.
By way of background, AACC is the principal association of professional laboratory scientists--including MDs, PhDs and medical technologists. AACC's members develop and use chemical concepts, procedures, techniques and instrumentation in health-related investigations and work in hospitals, independent laboratories and the diagnostics industry nationwide. The AACC's objectives are to further the public interest and educational activities and to help maintain high professional standards.
If you have any questions or we may be of any assistance, please call me at (405) 271-3571 or Vince Stine, AACC's Government Affairs Director, at (202) 835-8721.
K. Michael Parker, PhD