	Background

The final medical privacy regulation requires that most providers obtain patient consent to use or disclose health information before engaging in treatment, payment, or health care operations. The consent form must alert patients to the provider’s notice of privacy practices (described in a separate document) and notify them of their right to request restrictions on the use and disclosure of their information for routine health care purposes. Most Providers Obtain Consent to Disclose Patient Data for Insurance Payment

The extent to which the privacy regulation’s consent requirement will be a departure from business as usual varies by type of provider. The new consent requirement makes several important changes to current practices that have implications for patients and providers. In general, these organizations do not favor written consents for routine uses of patient information, although they support the regulation’s requirement to provide patients with privacy notices. Under the regulation, a patient must sign a consent form before a pharmacist can begin filling the prescription. AHA and Allina Health System representatives stated that the consent requirement could impede the ability of hospitals to collect patient information prior to admission, thus creating administrative delays for hospitals and inconvenience for some patients. Physician and hospital groups expressed concern that the requirement would hinder their ability to conduct health care management reviews using archived records. Concluding Observations

The privacy regulation expands the scope of the consent process to include the use and disclosure of personal health information for a wide range of purposes.
What GAO Found

The Department of Health and Human Services issued a final regulation in December 2000 that established rights for patients with respect to the use of their medical records. The regulation requires that most providers obtain patient consent to use or disclose health information before engaging in treatment, payment, or health care operations. The privacy regulation's consent requirement will be more of a departure from current practice for some providers than for others. Most health care providers, with the exception of pharmacists, obtain some type of consent from patients to release information to insurers for payment purposes. The new requirement obligates most providers to obtain consent before they can use and disclose patient information. It also broadens the scope of consent to include treatment and a range of health care management activities. Supporters of the requirement believe that the process of signing a consent form provides an opportunity to inform and focus patients on their privacy rights. Others, however, are skeptical and assert that most patients will simply sign the form with little thought. In addition, provider and other organizations interviewed are concerned that the new consent requirement poses implementation difficulties. They contend that it could cause delays in filling prescriptions for patients who do not have written consents on file with their pharmacies, impede the ability of hospitals to obtain patient information prior to admission, hamper efforts to assess health care quality by precluding the use of patient records from years past, and increase administrative burdens on providers.