Health Industry Winning Round On Privacy Of Digital Health Records

Lobbyists for the health industry are close to a victory over consumer groups in a dispute about when patients should be told their digital medical records have been lost, stolen or mishandled.

The tug-of-war over a little-known federal privacy rule--which has drawn in Congress, regulators and an array of interest groups--highlights the behind-the-scenes activity touched off by the government's effort to spend some $45 billion in economic stimulus funds to push medical data online. Federal regulators are working against tight deadlines to write all kinds of rules governing the digital system, one that the Obama administration hopes most health care providers will adopt in the next five years.

As with many Washington initiatives, the way the rules are written may have more of an effect on consumers than the original law passed by Congress.

One of the most contentious questions so far is when--and how--health care providers will have to notify patients if their privacy is breached.

Some lawmakers, consumer groups and industry analysts argue that hospitals and insurance companies should be required to let patients know about any unauthorized disclosure of their health data. However, under a provisional rule released by regulators from the Department of Health and Human Services, a health care provider only would have to notify patients if the provider determines the breach "poses a significant risk of financial, reputational, or other harm to the individual.'' Huffington Post