Medical Privacy Regulation: Questions Remain About Implementing the New Consent Requirement

The Department of Health and Human Services issued a final regulation in December 2000 that established rights for patients with respect to the use of their medical records. The regulation requires that most providers obtain patient consent to use or disclose health information before engaging in treatment, payment, or health care operations. The privacy regulation's consent requirement will be more of a departure from current practice for some providers than for others. Most health care providers, with the exception of pharmacists, obtain some type of consent from patients to release information to insurers for payment purposes. The new requirement obligates most providers to obtain consent before they can use and disclose patient information. It also broadens the scope of consent to include treatment and a range of health care management activities. Supporters of the requirement believe that the process of signing a consent form provides an opportunity to inform and focus patients on their privacy rights. Others, however, are skeptical and assert that most patients will simply sign the form with little thought. In addition, provider and other organizations interviewed are concerned that the new consent requirement poses implementation difficulties. They contend that it could cause delays in filling prescriptions for patients who do not have written consents on file with their pharmacies, impede the ability of hospitals to obtain patient information prior to admission, hamper efforts to assess health care quality by precluding the use of patient records from years past, and increase administrative burdens on providers.