Imagine your worst enemy.
Got them in mind?
Ok, now imagine how you'd feel if your medical records were given to them without your consent.
The Trump administration is considering sweeping changes to the regulations implementing the HIPAA Privacy Rule that would eviscerate the federal guarantee of patient privacy.
• Patients who have a diagnosis of serious mental illness (SMI) or opioid use disorder (OUD) could have their medical records released without their consent.
• Even clinicians who want to protect the privacy of their patients could be forced to release confidential medical records to other clinicians.
We have until February 12, 2019 at 23:59 ET to submit official comments telling HHS that #PatientPrivacyISPatientSafety.
I won't dive into each area HHS has included in their "Request For Information" here because the brilliant Erin Gilmer, Esq. has already written a post summarizing all of the changes HHS is considering. Here are the two changes that most concern me:
a. Releasing PHI Without Patient Consent
HHS is considering re-writing the Privacy Rule to allow healthcare entities to disclose, without the patient's consent, Protected Health Information (PHI) to "family members, caregivers, and others."
To others. Or, to put that another way: to anyone.
b. Mandating Release of PHI to other entities
HHS is considering fundamentally changing how PHI is demanded by, and released to, both covered and non-covered entities. As Attorney Gilmer explains, this could mean:
• If a doctor is required to share information with other doctors, you will have no say in it and it will not be the minimum necessary.
Example situation: A patient sees a psychiatrist but does not want their primary care physician (PCP) to know because they are afraid of stigma. The patient tells the psychiatrist not to share the notes with other doctors and they agree that’s in the patient’s best interest. The PCP finds out the patient saw a psychiatrist and asks for the record from the psychiatrist. The psychiatrist has to provide them and at the next appointment the patient receives biased care based on their stigma.
Example situation: A patient had an abortion a long time ago. They don’t want anyone to know but the doctor who performed the procedure. They now are seeing a new doctor and that doctor sends over a request for records. Now the new doctor will have a copy of the records with notes on that abortion.
• If a doctor is required to share all your information with insurers, insurers may discriminate against you or deny you care.
Example: An insurer is looking at whether to approve a prior authorization for a medication your doctor ordered. The insurer requests information from the doctor that is more information than the insurer needs to know (more than the minimum necessary) to make this determination. The insurer finds a note in the chart that they use to deny your prior authorization.
• If standards for sharing information with social services agencies, community-based support programs, court programs, or others are relaxed, your health information may get into the wrong hands.
Ex: (the OCR admits this could happen), information about your health is shared with a drug-court and puts a person at legal risk, including issues with child custody.
Ex: Information is shared with a social services program that arranges housing, the landlord finds out about your health issues and denies your application for housing.
If you're a policy wonk or member of the media who wants to dive deeper into these specific proposals, Attorney Gilmer has a deep-dive here.]
II. What You Can Do About It
We need to submit official public comments to HHS opposing these rule changes.
HHS has requested that we provide them with "information" in response to their proposals. We can submit public comments via the regulations.gov portal at this specific link. This is a crash course in submitting an effective comment.
a. Why Should You Listen To Me?
I'm a healthcare lawyer; my graduate training is in law and in public health. As a lawyer I'm trained to work with regulatory materials – read, understand, comment on. (Although I am not your lawyer.) And my particular focus is on healthcare and healthcare adjacent issues. And I've helped clinician communities successfully oppose other bad rules from the Trump administration. (References available from #medtwitter.) In other words, I'm an expert.
b. How To Comment Effectively
A crash course by way of some pearls & pro-tips:
1. Start with your qualifications
It is vital that you explicitly list your qualifications – in detail. Much of the power of your comment comes from your expertise, the most important way you establish your expertise is by describing your qualifications and experience. Your qualifications matter. If you have questions about how to present your qualifications, please feel free to contact me.
Start your comment by hammering your qualifications. Obviously, don't lie, but don't minimize either. The more impressive your qualifications read to a officials in HHS, the more impact your comment will have. You are not bragging, you are advocating for patients.
i. Mental Health Professionals
If you're a mental health professional (be it MSW/LCSW, PsyD, PhD) tell the reader about your qualifications. Assume the reader knows very little about the educational requirements for your degree. Did you write a thesis relevant to your comment?
Did you complete hundreds of hours of supervised field work with patients/clients? Have you trained/supervised others in this area? Tell the reader. If you are board certified, tell the reader. Tell the reader if you’re licensed, e.g. "I am a licensed psychologist in New York."
If you've contributed to an academic text or published in the peer-reviewed literature on any topics related to your comment, tell the reader. Use the phrasing that's most impressive. e.g. "I have 7 publications in the peer-reviewed literature" or "I've published on intimate partner violence in the peer-reviewed literature, including in the Journal of Social Work.” Have you worked with patients/clients dealing with the effects of relevant issues (DV/IPV/abuse/etc/etc/etc)? Tell the reader.
If you're a MD/DO, be explicit & assume the reader knows very little about medical education, e.g. "I graduated with an M.D. from Northwestern University. I completed a 3 year residency in Emergency Medicine at Mount Sinai Hospital. I then completed a 2 year fellowship in Critical Care at George Washington Univ, where I also earned an MPH.”
Tell the reader if you're licensed, e.g. "I am licensed to practice medicine in New York."
List every board certification you have, e.g. "I am board certified in Psychiatry."
If you have multiple, relevant degrees (like an MD and PhD or MPH) explain them with the same specificity. Tell the reader what your MPH concentration was or the topic of your PhD dissertation.
Include any academic medical appointments you may have, e.g. "I am a (lecturer/assistant professor/associate professor/professor) of (medicine) at the University of Chicago School of Medicine."
If you've contributed to an academic text or published in the peer-reviewed literature on topics relevant to your comment, tell the reader. Use the phrasing that's most impressive.
I cannot overemphasize the importance of maximizing the impact of your qualifications. Have you presented at conferences? Taught at grand rounds? Taught continuing education to other clinicians relevant to the subject of your comment? Supervised trainees? Tell the reader.
You're writing to HHS, and, quite possibly, ultimately to a federal judge. Obviously, belligerence or snark aren't likely to persuade that reader. Your knowledge, expertise, experience, and command of the peer-reviewed literature, on the other hand, are persuasive.
3. Use headings and subheadings
Make your comment as user-friendly for the reader as possible by using headings and sub-headings as sign-posts to guide your reader through your points.
4. Topic sentences
Don't hide the ball. Your reader should be able to understand the crux of your comment from the first sentence of each paragraph.
5. Tell, don't ask questions
Make statements, don't ask questions. Questions leave the reader with wiggle-room.
III. What To Write About
Tell HHS why privacy is important for patients with SMI and/or SUD.
- Explain to HHS why, in light of your expertise and experience, removing privacy protections from those patients is likely to cause harm.
- Tell HHS whether you want to be forced to reveal the confidential medical records (including home address, telephone numbers, work location, diagnoses, etc etc etc) to other clinicians who may be giving that info to those abusing your patient.
- What would these changes mean for patients who have survived intimate partner violence / domestic violence / etc? For patients who have had to go into hiding from abusers intent on killing them?
- What would these changes mean for LGBTQIA patients? How could these changes be weaponized against trans* patients? What might they mean for an 18 year old trans* kid who had to leave 'home' to escape being forced into conversion therapy?
As you know, there's no definitive list of mental health diagnoses that are considered Serious Mental Illnesses. NIMH offers a definition that could include most mental health diagnoses
NIMH has defined SMI as basically:
- any mental health dx (except developmental or SUD)
- found in the DSM
- that "results in serious functional impairment, which substantially interferes with or limits one or more major life activities."
...that could be almost anything
The implications of this proposed policy change for the trans* community are potentially catastrophic. "Healthcare providers" could use a diagnosis of dysphoria to justify giving trans folx medical records to abusers.
Some of the most vulnerable patients would be catastrophically harmed by eviscerating the Privacy Rule. We only have until 2/12/19 at 23:59 ET to submit comments opposing this change.