The new health privacy regulation, which came from the Health Insurance Portability and Accountability Act of 1996, has traveled a long road since its inception. In fact, the regulations were not part of the original legislation.
HIPAA began as the Kennedy-Kassebaum bill, bipartisan legislation that sought to ensure continuing health insurance coverage when employees change or lose their jobs. There was no language about protecting individual’s health information in the original bill. While the Kennedy-Kassebaum bill was eventually tabled, its equivalent in the House was adopted as law.
Late in the health insurance debate, a section called “Administrative Simplification” was added to the bill, which provided a standardized means of electronically submitting health information. This section was added to simplify the process of submitting insurance and, at the same time, to offset the cost of the increased health insurance coverage.
At the same time, the Senate Labor and Human Resources Committee (now the Health, Education, Labor and Pensions Committee) was debating a separate health privacy law, led by Sen. Bob Bennett, R-Utah. Bennett’s bill, the Medical Records Confidentiality Act of 1995, got bogged down in committee. It seemed clear that there would not be a stand-alone health privacy law, said Peter Swire, the Office of Management and Budget’s chief counselor for privacy during the Clinton Administration.
The timing of the medical privacy failure and the insurance bill matched. The privacy provision was added during the House and Senate conference – in which differences between bills passed in the two chambers of Congress are resolved – just days before Congress passed HIPAA and sent it to the president.
Under the privacy section of HIPAA, Congress had three years – until August 1999 – to enact legislation.
The addition of a privacy provision was a “catch-all with the idea that Congress had a homework assignment,” said Swire.
If Congress did not pass legislation, HIPAA mandated that Health and Human Services issue regulations.
Despite a number of proposals, nothing could get out of committee. Congress’ deadline passed, and HHS Secretary Donna Shalala published proposed rules, called the “Standards for Privacy of Individually Identifiable Health Information” – what is commonly known as the Privacy Rule – in November 1999. A comment period, which lasted until February 2000, resulted in 52,000 public comments, including one from the Society of Professional Journalists.
The final rule was released December 28, 2000, less than one month before President Bill Clinton left office. But the administration did not formally file the regulations with Congress and the General Accounting Office, which allowed the new administration to delay its implementation. Again, the regulation opened for public comments.
The Bush administration decided that the privacy rule should become effective as originally planned – despite rumors that it would be completely abandoned – and HHS would continue to work to clarify and modify the rule. Compliance was set for April 14, 2003.
In July 2001, HHS issued guidance on the rules and, in March 2002, published proposed modifications. Organizations, including SPJ, again submitted comments. The final modifications to the privacy rule were published in August 2002. While these modifications made some significant changes that the health industry lobbied for, it had no effect on provisions that are currently hindering reporters.
Why didn’t reporters know much about this law until April, when compliance began?
Both newspaper and health associations say that reporters largely ignored the privacy rules until April because it had little effect on their reporting.
“The response from the media, for the most point, up until April was pretty minimal,” said Tonda Rush, the National Newspaper Association’s director of public policy in Washington. “For the press, (the mentality was that) it hadn’t really happened yet.”
NNA and other media organizations have been actively involved in the lobbying process to alter these rules, submitting comments and meeting with officials. In addition to lobbying HHS, Rush said she wrote, in September 2002, a training pamphlet that was largely ignored by the media.
Jeannie Cross, head of communications for the Healthcare Association of New York State, a hospital advocacy group, said her organization held a meeting at Newsday to explain the new regulations. Only one Newsday reporter and a freelancer attended.
“None of the people who call the hospitals every day [attended],” she said.
She had more success at another meeting in the Adirondack region of upstate New York, where three newspaper reporters and a radio reporter attended.
“Reporters just weren’t interested,” Cross said.
Sarah Lechner was a summer Pulliam/Kilgore legal intern with Baker & Hostetler, SPJ’s First Amendment law firm in Washington, D.C.
