New Medical Privacy Rules May Pose Significant Challenges.

Sweeping new rules were issued to protect the privacy of Americans' medical records in the final days of the Clinton administration.

Several years in the making, the final privacy rules apply to health care providers, hospitals, health plans, insurers, and health care clearinghouses--virtually every individual or organization that handles medical records.

At press time, most organizations had not had a chance to digest the more than 1,500 pages that make up the final rules, which are published in the Federal Register. The Department of Health and Human Services received more than 52,000 public comments--most of them positive--on the proposed privacy rules that were issued in 1999. The final rules will go into full effect in 2003.

In a major change from the proposed rules, which covered only electronic records, the final rules also apply to paper records and oral communications.

Congress ordered the HHS to draft the regulations after failing to pass the Health Insurance Portability and Accountability Act, legislation that was intended to protect the privacy of medical records.

The new rules require patient consent for the release of their medical records, ensure that patients have the right to access their medical records, restrict disclosure of health information to the minimum needed for an intended purpose, establish new sanctions for improper use of private information, and create new requirements for researchers and others seeking access to private medical data.

Violation of the privacy rules can come at a steep price. Civil monetary penalties for noncriminal violations of the rules, such as accidental disclosure of private information, range from $100 to $25,000. Fines for criminal (intentional) violations can run up to $250,000 and 10 years in prison, with the highest penalties reserved for the malicious sale, transfer, or use for commercial gain, of private data.