Privacy of Individually Identifiable Health Information

---

AARC Letter to DHHS Regarding Proposed Rule on Standards for Privacy

February 17, 2000

U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attention: Privacy-P
Room G322-A, Hubert H. Humphrey Building
200 Independence Avenue, S.W. Washington, D.C. 20201

RE: Proposed Rule on Standards for Privacy of Individually Identifiable Health Information (45 CFR Parts 160 Through 164)

To Whom It May Concern:

The American Association for Respiratory Care (AARC) has reviewed the proposed rule regarding standards for privacy of individually identifiable health information published in the Federal Register on November 3, 1999. The AARC is a national professional association representing approximately 31,000 Respiratory Therapists (RTs) across the country. We appreciate the opportunity to comment on the proposed rule, and we respectfully submit the following remarks.

Respiratory therapy is a highly specialized allied health discipline focused on the management and treatment of lung disease and illness. RTs practice in all health care settings, and transmit health information for the patients they treat.

The AARC commends the efforts of the Department of Health and Human Services (HHS) to safeguard the protected health information (PHI) of patients. We support the concept in the proposed rule that allows the transmission of information for treatment, payment, and health care operations without individual authorization. A smooth flow of health information is essential to patient care and the health care system.

Research

In general, the AARC is concerned that several sections in the proposed rule may present significant and costly barriers to legitimate and necessary uses of health information. In particular, the AARC is concerned with the section outlining the manner in which a covered entity may use or disclose PHI for research purposes.

The analysis of health data is vital to understanding outcomes and developing more effective methodologies for treating patients. A great deal of health-related research begins as small analyses that are neither funded nor overseen by an Institutional Review Board (IRB) or privacy board.

For example, a RT may analyze patient outcomes from a specific respiratory therapy treatment protocol within his/her department or facility in order to assess the effectiveness and quality of care. This information is sometimes shared with the general population verbally or in writing.

However, under the proposed rule, the knowledge gained through this analysis may not be able to be shared if the original project did not go through an IRB or privacy board. To require these types of analyses to go through IRB or privacy board review is overly burdensome when the research involves aggregated patient statistics, and there is no interaction with or effect on the patient.

Governmental Health Data Systems

The proposed rule permits covered health entities to disclose PHI for inclusion in State or other governmental health data systems that collect health data for analysis in support of policy, planning, regulatory, or management functions. The AARC supports this disclosure of PHI to State and other governmental agencies in order to operate health data collection systems to analyze and improve the health care system.

Covered health entities sometimes disclose PHI to organizations in the private sector for the purpose of health data analysis. Most of this activity is covered in the proposed rule under the section on Treatment, Payment, and Health Care Operations. However, this section may not encompass all activities, such as sharing PHI with external entities (e.g., researchers) for analysis that furthers effective and efficient health care delivery.

Oftentimes, the PHI that is shared includes patient demographic information (e.g., zip code and county), clinical information (e.g., procedure codes), and financial information. External entities, such as researchers, may use this information to analyze utilization of local health care resources, health care costs, and quality of care, among others.

While the proposed rule acknowledges the value of releasing PHI to government health data systems, comparable health data systems in the private sector are not recognized. The AARC believes that PHI used by health data systems in the private sector should be considered outside the scope of this regulation when such information is de-identified on a reasonable basis.

Summary

The AARC believes that any effort to protect patients’ need for privacy must be balanced with their need to receive high quality health care. We do not believe it was the intent of the Administrative Simplification section of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 to negatively impact the delivery and cost of health care. However, without changes to the proposed rule, this regulation could have a negative impact on health care quality improvements that result from research efforts.

The AARC appreciates the opportunity to submit comments on this important rule. We look forward to working on solutions to this issue that will protect patients’ privacy and promote quality health care.

Respectfully submitted,

Sam P. Giordano, MBA, RRT, FAARC
Executive Director
American Association for Respiratory Care