Specifically, the rule  provides the following:  Access to and amendment of health information. Although many  provider and health plan organizations reported dealing with various  ongoing problems, they noted that two provisions were particularly  burdensome:  the requirement to maintain a record of certain disclosures  of patient information and the requirement to create business associate  agreements with downstream users of protected health information. In addition to difficulties experienced when tracking disclosures of  protected health information, provider and health plan representatives also  expressed concern about the volume of disclosures that must be tracked. Researchers pointed  to increased difficulty in obtaining patient data to conduct clinical or health  services research. State and Federal Agencies Have Had to Increase Efforts to Obtain Data for Public Health Monitoring

Organizations representing state public health officials told us that the  Privacy Rule has hindered access to patient health information because  some providers are reluctant to report to public health authorities. BCBSA reported that some plans are confused about how to  implement the Privacy Rule’s provisions for releasing information to  families, friends, and others. Evidence Suggests Patients Are Not Aware of Privacy Rights or May Misunderstand the Privacy Rule

Numerous organizations reported that patients are not aware of their rights  under the Privacy Rule, either because they do not understand the notice of  privacy practices, or because they have not focused their attention on  privacy issues when the notices are presented to them. Representatives of providers and health plans also stated that patients are  largely unaware of their rights. MGMA told us that OCR has placed the burden of patient education on  private organizations—such as professional associations, providers, and  health plans—and that some of these organizations interpret the rule  incorrectly. Complaints Filed with HHS OCR Indicate That Patients May Misunderstand the Privacy Rule

In the first year that entities were required to be compliant with the Privacy  Rule, consumers and others filed 5,648 privacy-related complaints with  OCR. For the rest of these germane complaints (11.5  percent of total closed cases), OCR determined that no violation had  occurred. Nevertheless, for each of these major provider types, as well  as for all other entities cited in privacy complaints, OCR found that a clear  majority of the complaints it closed were not germane to the regulation  because they either involved accusations of actions that were not  prohibited by the regulation, involved entities that were not “covered  entities” as defined by the Privacy Rule, or involved actions that occurred  before covered entities were required to be compliant (see fig. However, some operational issues and misconceptions about the rule  continue to raise concerns. Recommendations for Executive Action

We recommend that to reduce unnecessary burden on covered entities and  to improve the effectiveness of the Privacy Rule, the Secretary of HHS take  the following two actions:   Modify the Privacy Rule to (1) require that patients be informed in the  notice of privacy practices that their information will be disclosed to  public health authorities when required by law and (2) exempt such  public health disclosures from the accounting-for-disclosures provision. Agency Comments and Our Evaluation

In written comments on a draft of this report, HHS agreed with our finding  that implementation went more smoothly than expected during the first  year, confusion has diminished, and new privacy procedures have become  routine practice for staff.
Why GAO Did This Study

Issued under the Health Insurance Portability and Accountability Act of 1996, the Privacy Rule provided new protections regarding the confidentiality of health information and established new responsibilities for providers, health plans, and other entities to protect such information. GAO reviewed (1) the experience of providers and health plans in implementation; (2) the experience of public health entities, researchers, and representatives of patients in obtaining access to health information; and (3) the extent to which patients appear to be aware of their rights.

What GAO Found

Organizations representing providers and health plans told us that implementation of the Privacy Rule went more smoothly than expected during the first year after most entities were required to be compliant. In addition, they reported that new privacy procedures have become routine practice for their members' staff. However, provider and health plan representatives also raised a variety of issues about provisions that continue to be problematic. In particular, many organizations emphasized that two provisions--the requirement to account for certain information disclosures and the requirement to develop agreements with business associates that extend privacy protections "downstream"--are unnecessarily burdensome. Some organizations suggested that difficulties with these provisions could be ameliorated with modification of certain provisions and further guidance from the Department of Health and Human Services' Office for Civil Rights (OCR). Organizations reported a number of challenges faced by entities that rely on access to health information for public health monitoring, research, and patient advocacy. Public health entities noted that some states have had to take concerted action to ensure that providers' concerns about complying with the Privacy Rule do not impede the flow of important information to state health departments and disease registries. Some research groups asserted that the rule has delayed clinical and health services research by reducing access to data. Some consumer advocacy groups told us that patients' families, friends, and other representatives have experienced unnecessary difficulty in assisting patients. These groups perceived that while providers and plans are allowed, in certain cases, to disclose health information without written patient authorization, they are reluctant to do so. Consumer and provider representatives contend that the general public is not well informed about their rights under the Privacy Rule. According to these organizations, patients may not understand the privacy notices they receive, or do not focus their attention on privacy issues when the notices are presented to them. Some evidence of patients' lack of understanding is reflected in the 5,648 complaints filed with OCR in the first year after the Privacy Rule took effect. Of the roughly 2,700 complaint cases OCR closed as of April 13, 2004, nearly two-thirds were found to fall outside the scope of the Privacy Rule because they either involved accusations of actions that were not prohibited by the regulation, involved entities that were not "covered entities" as defined by the Privacy Rule, or involved actions that occurred before covered entities were required to be compliant. Of those cases that were germane to the rule, OCR determined that about half represented cases in which no violation had occurred.