Baylor University Medical Center Proceedings April 2014, Volume 27, Number 2 | Page 90

sources. The Congressional Research Service (CRS) is an independent part of the Library of Congress. It provides excellent
reports on a variety of questions received from congressmen and
their offices. Ordinarily, this service is not available to the public.
However, as an academician engaged in a scholarly endeavor, I
wrote to the director of the CRS asking for an exemption. My
request was never answered. Similarly, a letter to the director of
the Office of Civil Rights at HHS received no reply. Fortunately,
I was able to obtain a number of useful CRS reports through
a friendly connection to Congress. Another individual I knew
to be professionally involved with the system gave me further
access to important information. A copy of the new rule was
obtainable over the Internet (2).
In a preamble to the rule that went into effect in March
2013, the stated aims of this new version of HIPAA include,
among others, making business associates of covered doctors
and other entities such as medical practices and hospitals directly liable for compliance with HIPAA rules and regulations;
strengthening limitations on the use of protected patient information; expanding individuals’ rights to access of electronic
information; requiring changes and redistribution of notices
of privacy practices by physicians and hospitals; implementing more objective standards defining “harms” when privacy
is breached; and prohibiting most hospital plans from using
genetic information for underwriting purposes. No priority was
given to means of improving cooperation and understanding
between patients and their physicians.
Confronting the Omnibus Final Rule of 2013 was daunting, and not only because of its 563-page length. The routine
use of impenetrable legalistic jargon jarred the mind. Adding
to the bulk of material to be reviewed was the practice of printing an initially proposed version of a provision of the rule; this
was followed by public commenters’ input, often a response to
the commenters’ suggestions or objections, and then the final
version of the rule.
Since the new law incorporates portions of previous laws
still in effect, reference to these pepper the pages. These include the Health Information Technology for Economic and
Clinical Health Act of 2009, the Social Security Act, the Patient
Safety and Quality Improvement Act of 2005, and the Genetic
Information Non-Discrimination Act of 2008, among others. At every point I wished to examine and enlighten myself,
I found references to previous acts that were in effect, some
identified only by number and sections. An example on page
35: 164.504(c)(4)(ic)(B). I began to feel the same way I did
when I examined my first matryoshka doll, opening it up to
reveal its essence only to find a smaller but otherwise identical doll, containing a still smaller one, and so on, all smiling
inscrutably in colorful lacquered dress. If I was really to make
a legitimate study of the law, I would be compelled to open up
all the previously referred to laws now included in the 2013
document. This would no doubt take many months rather than
the several weeks I planned to devote to the project, and I seriously doubted whether, given the character of such legislative
documents—assuming I could acquire them—I would emerge
any better informed. I therefore settled on limiting the project
164

to extracting whatever few pieces of information I could that
might prove to be of some value to physicians and other socalled “entities” reading the law.
What about privacy? The ability of individuals to completely
control access to their personal medical records is the Holy Grail
of privacy rights advocates. The possibility of actually achieving
this is as much a myth as the Holy Grail itself. Were it seriously
attempted, the whole machinery of medical care administration
would come to a screeching halt. Insurance companies and billing services require such in formation to process charges. Institutions such as Medicare and Medicaid need this information to
audit their operations and plan for the future. Certain diseases
are classified as “reportable” in the interests of public health.
Immunization records are often required by school districts to
ensure protection of the children attending their schools. Such
requirements are actually recognized by the new law. Perhaps
the only type of care that may effectively adhere to the ideal of
personal privacy is psychiatric treatment, since this is so often
paid out of pocket directly to the psychologist or psychiatrist.
What about genetic information? This is a major component
within the 2013 rule, taking up almost 100 pages, about a fifth
of the document. With the recent advances in the field, this is a
highly charged, newly recognized element of medical care now
being given its proper due. Mercifully, this section contains
much writing that actually could past muster in English 101.
The rule prohibits “using or disclosing protected health information that is genetic information for underwriting purposes in all
plans covered in the HIPAA privacy rule.” It also distinguishes
between “manifest disease” (symptoms and physical findings
characteristic of a particular genetically based disease) and the
finding of a genetic component that may or may not coexist
(a genetic abnormality). This section would make worthwhile
reading for anyone practicing medicine where genetics is emerging as a primary factor.
What about decedent information? Knowledge about cause
of death and its relationship to various patient characteristics
has been critical in advancing the quality of medical care. The
new rule sets 50 years after demise as an appropriate period of
protection before postmortem information might be obtained
without permission from survivors of the deceased. While some
medical historians might find this satisfactory, with new diagnostic modalities and treatments occurring at a rapidly advancing rate and the need for their evaluation urgent, practitioners
and medical researchers might find this rule overly restrictive.
Those empowered to make disclosures about decedents are defined as those with first to fourth degrees of familial relationship. The marital bond appears to be given equal recognition.
No mention is made of civil unions, gay or lesbian, but those
primarily responsible for the decedent’s health concerns prior
to death appear to be given some consideration. Issues such as
removal from artificial life support systems, organ donation,
and permission for autopsy are not covered.
How much will the activation and continued support of
these new regulations cost? The estimate for the first year of
operation was $114 to $225 million, with an estimate of $14.5
million annually thereafter.

Baylor University Medical Center Proceedings

Volume 27, Number 2