Letter to Sec. Thompson from Some Members of Congress

March 20, 2001

The Honorable Tommy Thompson
Secretary of Health and Human Services
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201

Dear Secretary Thompson:

We are writing to express our concern with the recent decision to open a new 30-day comment period on the final medical information privacy standards mandated by the Health Insurance Portability and Accountability Act (HIPAA). The health privacy of Americans has been on hold for far too long, and we respectfully urge you to put these important privacy protections into effect right away.

This long-overdue regulation establishes for the first time a fundamental right to medical privacy. This new standard includes access to one's own medical records, a requirement of notice of how health information is going to be used and shared, a requirement of consent for use and disclosure, and limitations on employer access to personal health information.

At this point, further delay of these crucial protections would be a major setback in years of effort to grant Americans the privacy they have demanded for so long. Americans have waited long enough for privacy protections, and every day that this rule is not in effect, the confidentiality of their patient records are at risk. Therefore, we urge you not to delay these protections any further.

The process of developing the current regulation has been open and extensive. HIPAA, which passed with strong bipartisan support in both Houses in 1996, included a three-year deadline for Congress to pass a comprehensive medical privacy law. Understanding the importance of this issue, Congress built in a back-up plan giving the Secretary of Health and Human Services (HHS) the authority to promulgate a health privacy regulation in the absence of legislation by August 1999.

Over the years that this regulation was developed, the views of Congress and interested parties were given ample consideration. In September 1997, the Secretary of HHS presented recommendations to Congress for legislation on medical privacy. Subsequently, several bills were introduced but no law was passed. HHS then issued a proposed rule in November 1999, and even extended the comment period by 45 days at the request of industry and consumer groups. The Department then considered more than 52,000 comment letters over ten months before issuing a final rule.

We recognize that special circumstances may arise from time to time that are not fully anticipated in the regulation. For this reason, HHS is authorized in section 262 of HIPAA to work with the healthcare industry, providers, and consumers to resolve potential problems with compliance on a case-by-case basis. However, this process cannot begin until the covered entities move forward with implementing the rule.

We strongly urge you to hold the line on medical privacy by allowing the regulation to take effect on April 14th as originally provided. Americans have waited too long for these critical privacy protections; they should not have to wait any longer.

Sincerely,