May 2003

Grant Results

SUMMARY

In 1999, the Health Privacy Project of the Institute for Health Care Research and Policy at Georgetown University, Washington, published a compilation of health privacy statutes in all 50 states and a "consensus document" of best principles for shaping health privacy policy.

In 2002, the project produced an update of the 1999 state summaries.

Key Results

  • The Health Privacy Project's 1999 report, The State of Health Privacy: An Uneven Terrain, provided the first state-by-state guide to health privacy statutes.

    The compilation found relevant privacy provisions in statutes covering dozens of subjects, including:
    • Insurance.
    • Professional ethics.
    • Health care providers.
    • Licensing.
    • Adoption.
    • Foster care.
    • Public health.
    • Real estate.
    • Pharmacies.
    • Domestic violence.
    • Genetics.
  • The project also established a Health Privacy Working Group (See Appendix for list of members) to identify "best principles" for health privacy. Its report, Best Principles for Health Privacy, outlined 11 principles that should be considered when implementing comprehensive patient privacy policies and practices, including:
    • Personal identifiers should be removed from health information whenever possible.
    • Privacy protections established when information is collected should govern all use of that data.
    • Individuals should have the right to see and supplement their health information.
    • Individuals should receive notice about the use and disclosure of health information.
    • Except in limited circumstances, personally identifiable health information should not be disclosed without patient authorization.

Funding
The Robert Wood Johnson Foundation (RWJF) provided three grants totaling $449,563 to support this work from February 1998 and June 2002.

 See Grant Detail & Contact Information
 Back to the Table of Contents


RWJF STRATEGY

At the time of the initial grant, the U.S. Congress was considering health privacy legislation. One of the most difficult questions in the federal health privacy debate has been the interaction between state and federal laws.

 Back to the Table of Contents


THE PROJECT

The result of the first two grants (ID#s 033264 and 037287), the Health Privacy Project's 1999 report, The State of Health Privacy: An Uneven Terrain, provided the first state-by-state guide to health privacy statutes. (The second grant was made to supplement the first, and funded the hiring of a senior attorney to complete the analysis of state laws, which had proved more complex than originally expected.)

The compilation found relevant privacy provisions in statutes covering dozens of subjects, including insurance, professional ethics, health care providers, licensing, adoption, foster care, public health, real estate, pharmacies, domestic violence and genetics. (The report did not examine either administrative regulations or common law.)

State profiles covered patient access to medical records, restrictions on disclosure, privileges (i.e., provider-patient confidentiality in legal proceedings) and requirements governing specific health conditions. "[T]here is little probability that any federal law could match the breadth and scope of existing state laws. As such, any federal law that fully preempted state law would eliminate some of the rights and protections consumers currently enjoy and disrupt current state legal and regulatory structures," the report concluded.

The project also established a Health Privacy Working Group (see the Appendix for list of members) to identify "best principles" for health privacy. Its report, Best Principles for Health Privacy, outlined 11 principles that should be considered when implementing comprehensive patient privacy policies and practices, including:

  • Personal identifiers should be removed from health information whenever possible.
  • Privacy protections established when information is collected should govern all use of that data.
  • Individuals should have the right to see and supplement their health information.
  • Individuals should receive notice about the use and disclosure of health information.
  • Except in limited circumstances, personally identifiable health information should not be disclosed without patient authorization.

The report also called on health organizations to establish policies and procedures for the collection, use and disclosure of various kinds of health information. Draft federal health privacy regulations issued by the Department of Health and Human Services in November 1999 (after Congress had failed to pass legislation earlier that year) cited The State of Health Privacy: An Uneven Terrain and called it "the best and most comprehensive examination of State privacy laws currently published." The introduction to the final regulations, published in December 2000, cited both 1999 reports.

Communications

With the help of a subcontractor, Burness Communications, the project released the reports at two separate news conferences held in July 1999 at the National Press Club in Washington. The reports drew considerable media coverage, including articles and editorials in the Washington Post and USA Today, and expanded reporting on National Public Radio. Project staff and working group members were invited by the U.S. Congress to present testimony on findings of both reports as well as make presentations at a number of national meetings. Under the third grant (ID# 040780), the project produced an update of the state summaries in 2002. Both Best Principles and the revised state profiles are available at the project's Web site.

 Back to the Table of Contents


AFTER THE GRANT

The federal regulations, which do not preempt more stringent state laws, require states to analyze the interplay between state and federal privacy rules by 2003 (a process termed "preemption analysis"). This effort has generated considerable interest in the state profiles on the part of state and federal policy-makers, the media and the public, according to the project director.

 Back to the Table of Contents


GRANT DETAILS & CONTACT INFORMATION

Project

Health Privacy

Grantee

Georgetown University Medical Center (Washington,  DC)

  • The Health Information Privacy Project
    Amount: $ 342,203
    Dates: February 1998 to July 1999
    ID#:  033264

  • Supplement to the Health Privacy Project
    Amount: $ 19,903
    Dates: August 1999 to October 1999
    ID#:  037287

  • Updating The State of Health Privacy Report
    Amount: $ 87,457
    Dates: May 2001 to June 2002
    ID#:  040780

Contact

Janlori Goldman, J.D.
(202) 687-0880
goldmajl@georgetown.edu

Web Site

http://www.healthprivacy.org

 Back to the Table of Contents


APPENDICES


Appendix 1

(Current as of the time of the grant; provided by the grantee organization; not verified by RWJF.)

Health Privacy Working Group

Bernard Lo, Chair
Director, Program in Medical Ethics
University of California San Francisco
San Francisco, Calif.

Paul Clayton
Professor of Medical Informatics
Columbia Presbyterian Medical Center and Intermountain Health Care
New York, N.Y.

Jeff Crowley
Chair, Privacy Working Group
Consortium for Citizens with Disabilities and Deputy Executive Director for Programs
National Association of People with AIDS
Washington, D.C.

John Glaser
Vice President and Chief Information Officer
Partners HealthCare System
Boston, Mass.

Nan Hunter
Professor of Law
Brooklyn Law School
Brooklyn, N.Y.

Shannah Koss
Healthcare Security and Government Programs Executive
IBM Corporation
Washington, D.C.

Chris Koyanagi
Policy Director
Bazelon Center for Mental Health Law
Washington, D.C.

John Nielsen
Senior Counsel and Director of Government Relations
Intermountain Health Care
Salt Lake City, Utah

Linda Shelton
Policy Director
National Committee for Quality Assurance
Washington, D.C.

Margaret VanAmringe
Vice President for External Affairs
Joint Commission on Accreditation of Healthcare Organizations
Washington, D.C.

 Back to the Table of Contents


BIBLIOGRAPHY

(Current as of date of this report; as provided by grantee organization; not verified by RWJF; items not available from RWJF.)

Articles

Goldman J. "Protecting Privacy to Improve Health Care." Health Affairs, 17(6): 47–60, 1998. Abstract available online.

Pritts JL. "Altered States: State Health Privacy Laws and the Impact of the Federal Health Privacy Rule." Yale Journal of Health Policy, Law, and Ethics, 2(2): 327–364, 2002. Abstract available online.

Reports

Best Principles for Health Privacy: A Report of the Health Privacy Working Group. Washington: Institute for Health Care Research and Policy, Georgetown University, 1999. 2,400 copies printed.

Pritts J, Goldman J, Hudson Z, Berenson A and Hadley E. The State of Health Privacy: An Uneven Terrain. Washington: Institute for Health Care Research and Policy, Georgetown University, 1999. 1000 copies printed. Available online.

Pritts J, Choy A, Emmart L, Hustead J and Goldman J. The State of Health Privacy 2002: An Updated Summary of State Health Privacy Statutes. Washington: Institute for Health Care Research and Policy, Georgetown University, 2002. State summaries available online.

Presentations and Testimony

Janlori Goldman, Director, Health Privacy Project, "Making Patient Privacy a Reality: Does the Final HHS Regulation Get the Job Done?," to the Senate Committee on Health, Education, Labor, and Pensions, February 8, 2001, Washington.

Janlori Goldman, Director, Health Privacy Project, "Confidentiality of Patient Records," to the House of Representatives Subcommittee on Health of the Committee on Ways and Means, February 17, 2000, Washington.

Janlori Goldman, Director, Health Privacy Project, "Assessing HIPAA: How Federal Medical Record Privacy Regulations Can Be Improved," to the House of Representatives Subcommittee on Health of the Committee on Energy and Commerce, March 22, 2001, Washington.

Janlori Goldman, Director, Health Privacy Project, "Oversight Hearing on Medical Privacy," to the Senate Committee on Health, Education, Labor, and Pensions, April 16, 2002, Washington.

Joy Pritts, Senior Counsel, Health Privacy Project, "Implementation of the Federal Standards for Privacy of Individually Identifiable Health Information," to the National Committee on Vital and Health Statistics Subcommittee on Privacy and Confidentiality, October 30, 2002, Washington.

 Back to the Table of Contents


Report prepared by: Kelsey Menehan
Reviewed by: Robert Narus
Reviewed by: Marian Bass
Program Officer: Judith Whang

Most Requested