FTC Supports HHS Proposed Rules Regarding Privacy Protection of Consumers' Health Information

Standards proposed by the U.S. Department of Health and Human Services (HHS) for the privacy protection of personally identifiable health information -- which include an "individual authorization" or "opt-in" approach to the ancillary use of such information for purposes other than those for which the information was collected -- are strongly supported by the Federal Trade Commission. In response to HHS's request for comments on its proposed standards, the FTC offered HHS suggestions it may wish to consider to improve the disclosure requirements in two proposed forms -- the General Notice and the Model Authorization forms -- and suggested that HHS consider strengthening the proposed rule governing the contents of the written authorization that the consumer must provide to the covered health care provider in order for it to use a consumer's health information for purposes other than those for which it was collected.

Section 164.508 (a)(2) of the proposed HHS Rule, requires that covered entities first obtain written "individual authorization" before they use or disclose individuals' protected health information for any purpose other than health care treatment, payment, or healthcare operations. "We believe," the FTC comment stated, "that this opt-in,' or express consent,' requirement is the most appropriate approach for the use of sensitive medical information for purposes other than those for which it was collected."

The FTC noted in its comment that it has considerable expertise in addressing deceptive health care practices and has long had particular interest in, and gained considerable experience in dealing with, privacy and consumer protection issues. "Like personally identifiable information about children, personal medical information is among the most sensitive types of information collected from individuals," the comment explained, and "...consumers are most troubled by the prospect of unauthorized disclosure of medical information."

In addition, the FTC's comment offered suggestions that HHS may wish to consider that would strengthen the proposed rule governing the contents of the written authorization that the covered entity's request for individual authorization to permit ancillary uses of health information contain "[a] description of the purpose(s) of the requested use or disclosure." According to the FTC's comment, "this limited disclosure may not adequately inform consumers of the actual, intended use of the information," and "...might encourage or permit covered entities to use broad or vague language to describe the purpose of a requested use or disclosure." The comment noted that the disclosure should describe the intended uses "in sufficient detail to put the individual on notice of the uses and disclosures expected to be made of his or her protected health information." This standard helps ensure that individuals understand what uses and disclosures will be made of their sensitive health information. "Such understanding is crucial to ensure that individuals make informed choices about how their health information is used," the FTC said.

The Commission comment also addressed the requirement that covered health plans and health care providers give consumers adequate notice, by means of a "General Notice of Information Practices," of their policies and procedures with respect to health information -- containing an explanation of all of the patients' rights granted by the Rule, including rights to grant and revoke authorizations for ancillary uses and to request restricted use. "The Notice document is the only general disclosure and explanation of patients' rights required by the proposed Rule, and the information it contains is important to consumers' understanding of their rights under the Rule. For this reason, it is important that this notice not be buried in fine print, placed in inconspicuous locations, or otherwise hidden," the comment stated. The Commission also suggested that HHS may wish to consider requiring that the Notice be provided to the consumer under separate cover to make it more likely that the Notice satisfies the clear and conspicuous standard.

Finally, the comment suggested that HHS may wish to consider language and format changes to the proposed Rule's "Provider Notice of Information Practices" form and its "Authorization For Release of Information" form to help ensure that each form effectively communicates to patients important information about their authorization rights.

The Commission vote to submit the comment to HHS was 5-0.

Copies of the Comment are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580; 877-FTC-HELP (877-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.

(FTC Matter No. V000001)