HHS Secretary Thompson On the Privacy Regs Going Into Effect
April 11, 2003

From the time of Hippocrates, privacy in medical care has been of prime importance to patients and to the medical profession. Today, as electronic data transmission is becoming ingrained in our health care system, we have new challenges to insure that medical privacy is secured. While many states have enacted laws giving differing degrees of protection, there has never before been a federal standard defining and ensuring medical privacy. Now new federal standards are coming into force to protect the personal health information of every American patient.

As of Monday, April 14, millions of health plans, hospitals, doctors and other health care providers around the country must comply with new federal privacy regulations. To develop these regulations, the Department of Health and Human Services went through an extensive process of consultation and consensus that included reviewing and considering more than 100,000 public comments.

These new federal health privacy regulations set a national floor of privacy protections that will reassure patients that their medical records are kept confidential. The rules will help to ensure appropriate privacy safeguards are in place as we harness information technologies to improve the quality of care provided to patients. Consumers will benefit from these new limits on the way their personal medical records may be used or disclosed by those entrusted with this sensitive information.

The new protections give patients greater access to their own medical records and more control over how their personal information is used by their health plans and health care providers. Consumers will get a notice explaining how their health plans, doctors, pharmacies and other health care providers use, disclose and protect their personal information. In addition, consumers will have the ability to see and copy their health records and to request corrections of any errors included in their records.

Consumers may file complaints about privacy issues with their health plans or providers or with our Office for Civil Rights. The new rules also reflect a common-sense balance between protecting patients' privacy and ensuring the best quality care for patients. They do not interfere with the ability of doctors to treat their patients, and they allow important public health activities, such as tracking infectious disease outbreaks and reporting adverse drug events, to continue.

Over the past two years, we've worked aggressively to provide doctors, hospitals and other covered entities with the information that they need to comply with the rule. We've held a series of regional conferences on the privacy regulations and participated in hundreds of other conferences and meetings with those affected by the regulations. We've provided extensive guidance and other technical assistance materials that clarify key provisions of the rule, so those affected take the right steps but don't go overboard at the expense of the quality of their patients' care. Many of these materials, including an extensive collection of frequently asked questions, are on our Web site at http://www.hhs.gov/ocr/hipaa/assist.html.

We will continue our efforts to encourage covered entities to comply with the regulations' requirements. After all, this is the best way to ensure that patients get the rights and protections that they expect. Of course, we have all the enforcement options available to us under the rule, including civil monetary penalties, and we will use them as and when necessary to obtain our goal of protecting the confidentiality of personal medical information.