Rulemaking:

Standards for Privacy of Individually Identifiable Health Information

Stated Purpose:

"This rule proposes a standard to protect the privacy of individually identifiable health information maintained or transmitted in connection with certain administrative and financial transactions."

Summary of RSP Comment:

Our analysis suggests that the proposed rule could cost American health care consumers roughly one billion dollars per year. If the rule conferred tangible benefits in the form of increased privacy, as its preamble suggests, these costs might be worth incurring. However, the rule in its currently proposed form, offers limited tangible benefits for medical privacy protection, and in fact erodes the few protections that do exist.

Given limited benefits and high costs, in its currently proposed form, this rule may ultimately damage the long-term health of Americans. Indeed, it is quite possible that the rule may generate the perverse result of less privacy--owing to the pervasive availability of medical information combined with increased access by government agencies to that information. A less healthy citizenry may be one consequence, as individuals reduce prevention and treatment visits because of increased costs and reduced levels of medical privacy.

A more constructive approach may rest in clearly delineating ownership rights in the information and then clearly protecting those rights (including the use and disposal of that information). In this way, the Department could avoid imposing a costly, one-size-fits-all approach to medical privacy protections, while at the same time allowing individuals to seek--and plans and providers to offer--privacy protections that more closely parallel the desires and budgets of those concerned.