Published in the San Francisco Examiner, Sunday, August 10, 1997, Page A-4:

Washington---Clinton administration officials say they will propose a comprehensive federal
law to protect the privacy of medical records, to let consumers inspect their own files and to punish any unauthorized disclosures of personal data by hospitals, insurers, health plans or drug companies.

The measure would establish federal standards to control the use of such information in the era of managed care, when insurance companies and health maintenance organizations have the ability and, in many cases, a financial incentive to collect and sell data revealing the most intimate
secrets of millions of patients.

"Our private health information is being shared, collected, analyzed and stored with fewer federal safeguards than our video-store records," said Donna Shalala, Secretary of Health and Human Services. The administration plans to send detailed recommendations on medical privacy to Congress later this month, as required by the 1996 law that made health insurance more available to people who change jobs or lose their jobs.

"At present," Shalala said, "we rely on a patchwork of state privacy laws, only about a dozen of which are comprehensive. We have no real federal health care privacy standards. We have no national standards."

Robert Gellman, an expert on privacy and information policy, said the administration's proposals
"would impose greater restrictions on the use of medical records than any state law."

Most Protection Since Privacy Act.

If approved by Congress, the proposals would be the most significant protections for sensitive personal data since the Privacy Act of 1974, a landmark law that regulates the way federal agencies keep records on individuals.

The outlook for the administration's proposals on Capitol Hill is unclear. Many lawmakers from both parties demand greater privacy for health records. But few have focused on the details, which will be a subject of intense lobbying by the health care industry.

In translating abstract principles into concrete safeguards, lawmakers may offend companies with large financial interests in the use of personal health information.

The administration's proposals chart a middle ground. They reject the position of federal and state prosecutors who wanted unfettered access to medical records and an exemption from any new federal legislation. At the same time, the administration spurned the pleas of psychiatrists and the most outspoken privacy advocates, who wanted even stricter safeguards like giving patients a right to veto any use of their medical records.

Proposed Standards.

While declaring that "privacy rights can never be absolute," Shalala said Congress should establish a code of fair information practices. Specifically, she said, the administration will propose these standards:

People who improperly disclose medical records or misrepresent themselves to obtain such data should be subject to criminal penalties.

Information a Hot Commodity

The proposals come at a time when personal medical information has become a hot commodity, avidly sought by drug makers and othercompanies that want to identify potential product buyers.

"There is a whole market of people buying and selling medical information," said Kathleen Frawley, vice president of the American Health Information Mnagement Association, whose members keep the records at hospitals, nursing homes, doctors' offices and HMOs.

Shalala said the administration wanted to balance the needs of law enforcement and the privacy of patients. But exactly where to strike that balance is a subject of lively debate within the government.

Officials from the FBI and its parent agency, the Justice Department, as well as the inspector general of the Department of Health and Human Services, said they needed access to patients' records to build criminal cases.

Shalala summarized the issue this way: "Should auditors be able to peek through your private medical records looking for fraud commited by a doctor? Most people would say yes. Should law-enforcement officers be able to search through emergency-room records looking for someone who has just fled the scene of a crime? Most people would say yes.

"But," she asked, "what happens if law-enforcement officers are looking through insurance records for fraud and stumble upon information about a totally unrelated crime, say, drug use? What then?"

Administration officials said they were still wrestling with that question.