Leahy Calls for Strengthening Medical Privacy Rule
to Allow Private Right of Action
and to Cover Marketing of Private Medical Entries

February 8, 2001

[As the Senate Committee on Health, Education, Labor and Pensions convened an oversight hearing Feb. 8 on the final medical privacy regulations issued in December by the Department of Health and Human Services, Sen. Patrick Leahy praised the final rule but called on Congress to strengthen it by giving the public a private right of action to redress privacy violations and to extend its coverage to include re-use of private medical entries by marketers and others. Leahy, D-Vt., is the author of the Medical Information Privacy and Security Act (S.573), introduced during the 105 th and 106th Congresses, and in 1994 held Congress’s first hearing on privacy issues relating to electronic medical records. Leahy also chairs the Senate Democratic Task Force on Privacy. The final rule on the privacy of personally identifiable medical information was announced by President Clinton and HHS Secretary Donna Shalala on December 20, 2000, fulfilling statutory obligations, co-authored by Leahy, set by Congress in the 1996 Health Insurance Portability and Accountability Act, which directed HHS to develop medical record privacy rules if Congress failed to do so by Aug. 1999. Leahy released the following statement on Feb. 8:]

I commend Chairman Jeffords and Senator Kennedy for organizing today’s hearing to examine whether the medical privacy rules finalized in December by President Clinton will do the job in protecting patient privacy.

More than a dozen years ago, when Alan Simpson, Paul Simon and I passed the bill that we wrote to protect video rental records, I doubt that it occurred to any of us that one day soon everyone ’s video rental records would enjoy more protection than their medical records. Year after year, Congress has failed to stand up to the special interests to do the same for our medical records. It is wrong that people can give the most intimate details of their lives and their families’ lives when they seek medical care -- and then to see those records distributed for commercial or other gains.

Fortunately, this is about to change. When these landmark medical privacy rules go into effect, Americans will -- for the first time ever -- enjoy federal protections of their personal health information.

As a starting point, the public deserves to know three things about the final rule.

First, while these benchmarks should be strengthened in some respects, it is important to understand that these are good and balanced regulations. President Clinton and his administration did what Congress was unable to do.

Second, while these new rules are good, they are not perfect and there is room for improvement. Some provisions need to be closely examined, and there may need to be some changes. One area of concern to me is the explicit allowance of the use of personal medical information for marketing purposes. While some have described this section as being a positive step to allow patients to receive information about their conditions and about available treatments, it also is an invitation to abuse. Rather than allowing a patient the right to opt out of receiving unsolicited ads from individual marketers, as the final rule does, should a patient instead not have the right to opt in and choose to receive information related to their medical conditions?

Finally, there are some critical areas that Clinton Administration officials were unable to address in this rule because they were hampered by federal statute. Since the Administration had to do Congress’s job to develop and finalize these standards, I hope we in Congress at long last are willing and ready to roll up our sleeves to get down to work to put the finishing touches on this charter establishing medical privacy rights for the first time for all Americans.

What is left to do? Congress should take additional steps to create a private right of action so patients can hold health care providers and health insurance companies accountable for violating these standards. And these privacy protections must be extended to cover other entities that often come into contact with medical information, such as life insurance companies and workers’ compensation programs. Congress should also begin looking at the right ways to protect the re-use of medical information.

Any number of polls continue to show that privacy is one of the top issues that concern the public. Yet year after year, nothing happens in Congress. During the last Congress, the pressure from the special interest groups became so intense that there was not a single committee markup on medical privacy legislation. For too long Capitol Hill has talked the talk about privacy. Now Congress needs to begin walking the walk.

I look forward to working with others in the House and Senate toward the goal of strengthening the public’s medical privacy protections in this new session of Congress. We need to develop and introduce legislation to fill in these gaps and to strengthen the rule. Our task is to finish a job that, at long last, has now been commendably and responsibly started.