HHS Attempts to Clarify Medical Privacy Rule.

The Department of Health and Human Services has issued what it says is the first in a series of materials aimed at helping health care providers and health plans understand federal regulations governing the privacy of patients' medical records.

HHS stressed in the document, which it calls a "guidance," that it was not issuing a new privacy rule, only clarifying the requirements of the Health Insurance Portability and Accountability Act (HIPAA), which became effective on April 14. Most health plans and providers have until 2003 to fully comply with the rule; small plans have an extra year.

The 57-page document breaks questions about the privacy rule down into nine subject areas. Here are some highlights:

* Consent. Providers need to obtain a patient's written consent only once. Prior consent is not necessary in emergencies, when a provider is required by law to treat the individual, or when there are substantial communication barriers.

* Minimum necessary. Disclosures of information between providers for treatment purposes are exempt from the minimum necessary requirements.

The minimum necessary requirements do not prevent medical students or residents from accessing patients' medical records.

* Oral communications. Providers don't need to soundproof exam rooms to avoid the possibility that conversations are overheard. Health care providers and health plans do nor need to provide patients with transcripts of oral communications and do not have to document all oral communications.