‘New world’ imminent
for medical files

---

By Helen Altonn
haltonn@starbulletin.com

Federal privacy rules that go into effect Monday will put major restrictions on how hospitals and other health-care providers handle and distribute patient information.

The changes will affect families, medical facilities, doctors, insurers, florists, clergy, journalists and anyone else seeking information about or access to a patient.

"From now on, it's going to be a new world," Laura Sherrill said yesterday, referring to the privacy rules taking effect under the federal Health Insurance Portability and Accountability Act, called HIPAA.

Sherrill, manager of medical records at the Queen's Medical Center, chairs the privacy subcommittee of the HIPAA Readiness Collaborative of Hawaii Health Information Corp. More than 70 health-related organizations participated in setting guidelines for compliance to the federal mandate.

"It has taken us an awful long time to prepare for this," said Richard Meiers, president and chief executive of the Hawaii Healthcare Association, which represents all hospitals and most other nursing and care facilities.

Meiers said the implementation in Hawaii has been costly but is expected to be less than the $475 million estimated by consultants in 1999 because of rules changes.

At a news conference yesterday, Sherrill and Meiers described major effects of the privacy regulation at a news conference, including:

>> Written notice of privacy rights must be given to patients regarding use and disclosure of their health information. They will be asked to sign a form acknowledging receipt of the document at every medical facility, doctor's office and pharmacy.

>> Patients can say yes or no to release of any personal health information. They can ask to see their medical record and request changes to correct errors.

>> Protected information can be disclosed only for treatment, payment of services, health-care operations and releases required or permitted by law.

Hawaii's medical privacy law, passed in 1999, was considered a model for the federal law because it was the first to protect patients' health information. It was repealed in 2001, partly because the federal law was pending.

If a patient does not want to be listed in a hospital directory, no information will be released to anyone, including families, clergy, business associates and the media, Sherrill said. A florist trying to deliver flowers would be turned away if the patient opts not to be listed.

A hospital can only provide a one-word condition report, such as "undetermined," "good," "fair," "serious" or "critical," if a patient agrees to be listed in the directory and a query knows the patient's name. The hospital may say a patient died only if neither the patient nor the family asked that the information be withheld.

Exceptions for sharing information are allowed if it is required by law, for public-health purposes, involving abuse victims, health oversight, legal proceedings, limited law enforcement purposes, worker's compensation, specialized government functions, research, organ and tissue donations, or if a patient is a threat to self or others.

Sherrill said there are still questions about how hospitals will discuss information with family members because of some limits on how much can be released. Family members, especially calling from the mainland, will be frustrated because they will not get information they are accustomed to receiving, she said.

Hospitals and professional organizations have done extensive training to inform personnel and doctors about the new rules, the officials said. Every office and facility must have someone designated to answer privacy questions.

Federal civil penalties are $100 per civil violation up to $25,000 per year, and to $250,000 and/or 10 years in prison for a criminal violation.

One of the biggest problems, Sherrill said, is that people become anxious about what and when to release information when fines are imposed, so there may be some delays.

Meiers said there have been many complaints across the nation in recent years about misuse of medical information to employers or insurers.

Sherrill added that she does not know of any significant cases here, but "we have room to improve."