Altered States: State Health Privacy Laws and the Impact of the Federal Health Privacy Rule

Medical records contain some of the most intimate details about an individual that can be found in a single place. Health information privacy is based on the principle that individuals should be able to exercise control over this intimate information, both by having full knowledge about what information is contained in the records and by being able to control who has access to the information. Because professional ethical requirements do not adequately protect health information in today\u27s complex health care system, we have increasingly turned to the law as a source of protection. Until the recent promulgation of the Federal Health Privacy Rule, states have been the primary regulators of health information through their constitutions, common law, and statutory provisions. Although all three of these legal sources remain important, recent focus has been on the enactment of detailed health privacy statutes that apply the fair information practice principles to health information. However, for the most part states have adopted these principles in a fairly haphazard fashion resulting in a patchwork of legal protections both within and between states. The recently issued Federal Health Privacy Rule has effectively evened out some of this discrepancy by establishing a federal floor of privacy protections based on fair information practices. The Federal Rule, however, does not afford adequate protection of health information because it has limited applicability and areas of lax protection. Because the Federal Rule only preempts conflicting, less protective state laws, there is still room for states to protect their own citizens by retaining or enacting health privacy protections that mirror and improve upon those in the Federal Health Privacy Rule

Patients, privacy and trust: Patients' willingness to allow researchers to access their medical records

The federal Privacy Rule, implemented in the United States in 2003, as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), created new restrictions on the release of medical information for research. Many believe that its restrictions have fallen disproportionately on researchers prompting some to call for changes to the Rule. Here we ask what patients think about researchers' access to medical records, and what influences these opinions. A sample of 217 patients from 4 Veteran Affairs (VA) facilities deliberated in small groups at each location with the opportunity to question experts and inform themselves about privacy issues related to medical records research. After extensive deliberation, these patients were united in their inclination to share their medical records for research. Yet they were also united in their recommendations to institute procedures that would give them more control over whether and how their medical records are used for research. We integrated qualitative and quantitative results to derive a better understanding of this apparent paradox. Our findings can best be presented as answers to questions related to five dimensions of trust: (1) Are medical records kept confidential? (2) Does the research being conducted demonstrate high priority on patient welfare? (3) Are researchers held accountable and responsible for protecting privacy? (4) Are systems to protect medical records sufficiently secure? (5) Do researchers fully disclose the research being conducted and how medical records are used to conduct that research? Patients' trust in VA researchers was the most powerful determinant of the kind of control they want over their medical records. More specifically, those who had lower trust in VA researchers were more likely to recommend a more stringent process for obtaining individual consent. Insights on the critical role of trust suggest actions that researchers and others can take to more fully engage patients in research.USA Deliberative democracy Trust Privacy Medical records Health insurance portability and accountability act (hipaa) Health policy