Advertisement - Click to support our sponsors.

Doctors
fear new
privacy law

'They're afraid of the consequences'
of the confidentiality law
on medical information
-- 'It's so restrictive'

By Helen Altonn
Star-Bulletin

A new state law that protects the privacy of patients' medical information takes effect today in an atmosphere of confusion and fear among medical professionals.

"They're deathly afraid of going to jail and paying $100,000 (for violations)," said Moya T. Davenport Gray, director of the state Office of Information Practices.

The confidentiality law was passed last year after years of debate and work on the bill by a task force representing varied health care interests.

Goals are to protect personal health information from unauthorized use, to allow review of medical information to improve health care and prevent fraud and abuse, and to aid research that may lead to new treatments.

Task force members agree that the law is complex and has some holes that may need fixing by the next Legislature. But they say it is a good law that pushes Hawaii ahead of proposed federal regulations.

The Hawaii Medical Association has compiled a compliance packet to help physicians and malpractice carriers understand the requirements. The task force and OIP also are trying to educate the public and health care providers about the law.

Gray said physicians are "constantly saying, 'This is a terrible law.' They're afraid of the consequences. It's so restrictive."

"It covers a lot more than hospitals and doctors," points out Laura Sherrill, clinical information supervisor at Rehab Hospital. All employers and educational institutions that have health information are covered under the definition of "entity," she said.

Information on hospitalized patients cannot be disclosed without their permission to florists, relatives or news media.

The Society of Professional Journalists, Hawaii chapter, had urged that the bill be vetoed, arguing that it will deter reporting of severe crimes and accidents.

'Nobody is in charge of it'

Knowing and intentional violations would be Class B or C felonies with possible prison sentences and minimum fines of $5,000 or $10,000. Civil penalties up to $100,000 could be imposed for multiple violations.

Enforcement apparently has to come from patients through court action because no regulating agency is cited in the law.

"The law is out there now, and nobody is in charge of it in a way," said Sherrill. Without an agency designated to oversee it, she said, "It will be based on court interpretation."

Sherrill heads a subcommittee working on recommendations to the OIP for rules to clarify "administrative, technical and physical safeguards" to protect health information.

The difficulty is to balance patients' rights of privacy with public policy needs, she said.

Heidi Singh, HMA director of legislative affairs, cited concerns about "a little more bureaucracy, a little more administrative burden to comply with the law."

She said the Legislature made changes to the task force's proposed bill that made parts of it confusing. Some definitions are not clear, and a lot of things are coming up that the task force had no way of identifying, she said.

The task force reorganized into compliance, education and rules subcommittees to continue working on issues, she said.

The group plans to submit legislation "to clear up unintended consequences of the law now being identified as we go into implementation," she added. Gray said changes can be recommended if needed. "The question is, is there really a need, or just fear?

"There is confusion," she said. "The law is not a straightforward written document, and it does need some explanation."

It is hoped the rules will clear up some of the confusion, she said, adding that they will include an impact statement to help explain what they are intended to do.

Gray agrees with others who say the problem with the law is not so much what is in it, but what is not in it.

Many insurers are excluded, she said. "The impact is on those people who get paid from those insurers for services they provide to patients."

She said the task force is looking at the question of sharing medical information for workers' compensation, temporary disability insurance and other areas in which an injured employee receives a mandated benefit.

Doctors, hospitals and health plans generally feel they always protect the privacy of medical records, but they differ on what "privacy" is, Gray said.

'It is a very complicated law'

The impact of technology also must be considered as doctors shift from paper records to electronic transactions, she said.

Under the present system, a doctor or hospital gets a blanket consent to release information, saying whom it can go to but not what the third party can do with it, Gray noted.

Under the new law, authorization for release of medical information must include a description of what it is about, who is making the disclosure, who it is being disclosed to and for what purposes, she said. But consent is not needed to disclose patient information for treatment, payment or qualified health care operations.

Even after explaining the law in presentations to doctors, Gray said there is still some fear and a lot of frustration because many people are not prepared for it.

Singh said, "There is some concern with interpretation for everyone because it is a very complicated law. It's a leap of faith for many."

But much of what the state law requires will be ordered under federal regulations that were proposed last August and are under review, she pointed out.

Singh said HMA has received "a lot of panic phone calls," but physicians are reassured when they receive the association's packet explaining how the law works.

People with questions may call the OIP, their professional organization, HMA or their liability insurer for their physicians, she said.

Phyllis Baumwell Dendle, Kaiser Permanente government affairs director who chairs the task force compliance subcommittee, said the law is incomplete. "So as people go to implement it, there are questions how to do this. ... We are looking at some of the gaps."

She said the committee hopes to come up with a community standard for some questionable areas so hospitals, physicians and insurers are going in the same direction.

Health plans advised to educate

Most of what the law requires has been practice, Dendle said. "We were all working very hard at protecting information. That's our ethical code, and we all have risk managers, so very little of this is new. What it does is standardize it."

Dr. Arleen Jouxson-Meyers, Hawaii Coalition for Health president, said fears are groundless that doctors will not be able to share information that affects a patient's treatment.

She said the law provides more latitude for transferring information to other doctors or hospitals who need it for patient care.

"Included in that are health insurance companies who process claims and scrutinize physicians in terms of fraudulent charges," she said. "Maybe doctors are going to be upset about that."

There are limitations, Jouxson-Meyers said, noting for example that if the Hawaii Medical Service Association wanted to go to her pediatric office and look at 100 records, she could challenge that. "They have to ask for only the number sufficient to accomplish whatever they're trying to do, and send someone qualified."

Jouxson-Meyers said the health plans are upset about the heavy penalties. "But we felt we were giving them leeway by including them in the health care definition, and there had to be sanctions to deter abuse."

Besides substantial fines, awards can be made of attorney's fees and costs, she said.

"The way the law is written, there have to be those strict safeguards ... so, in my opinion, the best thing for a hospital or health plan to do is learn what the law means and educate workers on what it means."

Patients' rights Patients under Hawaii's new privacy law will have a right to: Inspect and copy their medical records and appeal any denial of requests for inspection or copying. Exceptions are permitted under specified conditions. Ask health care providers to attach information to their protected medical record to complete it or improve the accuracy. Be notified of their privacy rights by their health plan upon enrollment, annually and when confidentiality practices are amended.

---

Legislature Directory
Legislature Bills & Hawaii Revised Statutes