Privacy President? Not When It Comes to Medical Records

Updated September 2, 2002

Add support for privacy of medical records to the list of campaign promises Bush has reneged on. In the June 5, 2000 issue of Business Week Bush said, "I'm a privacy-rights person.... The marketplace can function without sacrificing the privacy of individuals.... [C]ustomers should be allowed to opt in [to sharing information]. The company has got to ask permission." At the time, pollsters for both parties were noting public concern over access to financial and health care records, and worry that the government or corporations would misuse the information. Bush took credit for the wide-ranging privacy rules issued by former President Bill Clinton when they took effect in 2001. The Clinton rules required that health care providers obtain written permission from patients before using personal health information for any of a long list of health-care related activities or transactions. On August 9, in response to pressure from health care companies, the Bush administration formally rolled back the Clinton rules, including the consent requirement. The new rules had been first proposed in March, prompting public outcry and a hearing before Senator Edward Kennedy's Health, Education, Labor and Pensions (HELP) committee. "The administration appears more interested in protecting communications between the vice president and oil companies than between doctors and patients," said James C. Pyles, a lawyer for the American Psychoanalytic Association (APA).

In typical Bush administration fashion, the changes in regulations hinge on semantics. The Bush proposals still require health care providers -- including drugstores and insurers -- to obtain permission from a patient before "disclosing data for the purpose of marketing." But they redefine marketing so that it does not include recommendations of alternative treatments, drugs, therapies, or providers for individual patient care, even when a third party pays a covered entity to make the communication. "While the Department of Health and Human Services (HHS) ... HIPAA privacy regulation changes will reduce the burden on physicians and other healthcare providers, it is important to recognize they are inadequate to protect patients," APA president Richard K. Harding, M.D. told the HELP committee. Earlier this year, committee chair, Senator Edward M. Kennedy, said he would introduce legislation to prevent the administration from rescinding the consent requirement.

Some of the most compelling testimony at the hearing was from Janilori Goldman, Director of the Health Privacy Project (HPP) at Georgetown University. The Health Privacy Project is "dedicated to broadening access to health care, and improving the quality of care by ensuring that the privacy of people’s medical information is protected in the health care arena." The group also coordinates a coalition of over 100 groups with representation from consumers, providers, and advocacy organizations. HPP's mission is to enable people to participate in their own care and research without fear that "...sensitive health information will be used outside the core health care setting...."

Ms. Goldman observed that key provisions of the regulations put in effect in December 2000 were being threatened even though health care organizations have more than a year before they are required to comply fully.

Organizations that joined HPP in opposing the Bush administration proposals include:

Ms. Goldman referred to the findings of a 1999 survey for the California HealthCare Foundation that one out of six people "withdraws from full participation in their own health care" because of fear that health care information will be used without their permission. A government document issued under the aegis of the Labor, Justice, and Health and Human Services Departments in 1997 found that 63% of those surveyed would decline genetic testing if insurers or employers could obtain the results. Recent media reports serve to justify public concern, among them:

  • Eckerd's Drug Stores are under investigation in Florida for providing customer drug records to marketing campaigns for promotions and discounts.
  • A North Carolina resident was given a positive employment review and a raise, then summarily fired after being diagnosed with a genetic disorder requiring expensive treatment.
  • An Illinois woman who received medical treatment for complications following an abortion alleges St. Elizabeth's Medical Center released her medical records to anti-abortion activists.
  • A Motorola employee was enrolled by her employer in a "depression program" after her prescription drug management company released information that antidepressants had been prescribed for her.

... the current Privacy Rule grants people the right to see and copy their own medical records; requires health care providers to obtain patient consent before using their records for treatment, payment and health care operations; imposes limits on using medical records for marketing; imposes safeguards on publicly and privately funded research use of patient data; somewhat limits law enforcement access to medical records; and allows for civil and criminal penalties to be imposed if the Rule is violated.

The Bush administration changes eliminate the requirement that health care providers obtain an individual's consent prior to using protected health information, replacing it with a requirement that individuals acknowledge that their private information is being used. This change effectively eviscerates the Clinton regulations. From empowering patients to exercise discretion over how their medical information is used, as Ms. Goldman puts it, "[a]sking an individual to acknowledge receiving a privacy notice reinforces that the individual patient has absolutely no say in the matter."

In April of 2001 William Safire wrote, "In an action that left medical data-swappers sputtering with rage and the well-heeled intrusion lobby moaning about its "operational nightmare," President Bush struck a blow last week for the privacy of medical patients' records. Few expected Bush to make good on the belated rule changes his departing predecessor made that so offended health-care bureaucrats. But now doctors, hospitals and insurers are obliged to get patients' consent before passing around intimate personal information."

Whether it is an effort to shore up support within the health care industry to compensate for eroding support in Bush's conservative base, or that his campaign promises were just rhetoric, and emboldened by his still-high job approval he can now reveal his true policy, the privacy rules join global warming, free trade, and the nuclear waste dump (to name but three) among policy reversals from Bush campaign promises. During the campaign season of 2000, Democrats sought to frame the privacy discussion as a struggle between libertarians and consumers on one side, and big business on the other. Bush's strong pro-privacy campaign rhetoric deprived Gore, and to some extent other Democrats, of the leverage with the public that a pro-consumer stance toward privacy issues provided. Now that that the administration has revealed not only its true position on the issue, but increased its vulnerability to criticism that Bush's campaign promises were empty rhetoric, the issue may resonate more strongly with voters this time around. Unfortunately it is not a presidential election year.


Pear, Robert "Democrats Say Bush Revisions Ruin Medical Privacy Rules" NY Times 17 Apr. 2002.

Abadie, Julie "APA Urges Committee to Protect Patients and Close Medical Privacy Rule Loophole" American Psychiatric Association. Release No. 02-12. 16 Apr. 2002.

Safire, William "Essay; The Privacy President?" NY Times 19 Apr. 2001.

Borrus, Amy with Paula Dwyer "Surprise! Bush Is Emerging As a Fighter for Privacy on the Net" Business Week 5 Jun. 2000

Berke, Richard L. "Ideas & Trends: Rear Window; What Are You Afraid Of? A Hidden Issue Emerges" NY Times 4 Jun. 2000