The Honorable George W. Bush
The White House
1600 Pennsylvania Avenue, NW
Washington, DC 20500

Dear Mr. President,

We are writing to express our strong support for the timely implementation of the final medical privacy rule issued by the Department of Health and Human Services (HHS) on December 20, 2000. This final regulation was published in the Federal Register on December 28, 2000 and is scheduled to go into effect on February 26, 2001. We urge you to notify HHS Secretary Tommy Thompson and Mitchell E. Daniels Jr., Director of the Office of Management and Budget, that this regulation is exempt from the moratorium described in a January 20 memorandum from Andrew Card.

We have been involved in the issue of protecting the personal medical information of Americans for a long time. That is why we are very concerned about numerous recent reports about pressure from the health care industry for your Administration to delay the implementation of the medical privacy regulation. This would be a large mistake and the wrong message to send to Americans.

When Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996, there were extensive congressional discussions surrounding the need to implement strong privacy protections with the increasing use of technology required in HIPAA. The final law provided Congress three years to pass comprehensive medical privacy legislation. If Congress failed to meet its own deadline, HHS was required to establish medical privacy protections through administrative regulations.

Congress did fail to meet its own August 21, 1999 deadline and under the leadership of Secretary Donna Shalala, HHS issued draft regulations just two months later on October 29. The period for public comment was initially scheduled to close in early January but at the request of industry and consumer groups, the public comment period was extended. Ultimately, HHS received more than 50,000 comments on the proposed regulation. The Department carefully reviewed these comments and made changes to the draft regulation that both consumer and industry organizations have noted.

When Congress passed HIPAA, it anticipated that there may be some difficulty in implementing the administrative simplification provisions, including the medical privacy regulation, and included a method to resolve problems that may arise. Section 262 of HIPAA provides the Secretary of HHS with the authority to modify the rule any time during the first year after the standard is adopted when "necessary in order to permit compliance with the standard." Delaying the entire medical privacy regulation is not the way to address individual concerns regarding the implementation of the final rule.

The privacy of personal medical information is an important issue for Americans. This comprehensive and carefully crafted regulation must not be delayed. Rather, it should be implemented as scheduled to keep our commitment to Americans that their personal medical information is just that - personal and private - and it deserves protection.

Sincerely,

PATRICK LEAHY
United States Senator

Cosigned by Senators Harkin, Kennedy, Dodd, Kerry, and Inouye

cc: The Honorable Tommy Thompson, Secretary, Department of Health and Human Services