In December, President Clinton announced what were supposed to be final regulations governing medical privacy. The regulations contained two new policies: one good, one bad. The good policy: The regs require HMOs to get patient consent before seizing their medical records. The bad policy: The regs permit doctors, hospitals, pharmacists and other providers of health care to deliver patient records to marketers without patient consent. Imagine getting, for example, a letter that says in so many words, "We know you have hemorrhoids and are depressed. We urge you to buy Drug X for your hemorrhoids and Drug Y for your depression." It's legal under the new regs.

Guess which one of these policies is now under ferocious assault? Yup, the one requiring HMOs to get patient consent before reading patient medical records. Thanks to lobbying by the HMO and hospital industries, Tommy Thompson, the new Secretary of the Department of Health and Human Services (DHHS), announced in February that he will consider rewriting the Clinton privacy rules. House Majority Leader Dick Armey of Texas also sent a letter on March 5 to Secretary Thompson, urging him to block implementation of the Clinton rules.

Clinton's privacy regs were a surprise because his administration had endorsed the opposite policies in the draft regs announced back in October 1999 (see "Invasion of Privacy," August 21, 2000). The draft regs let HMOs rifle through patient files without consent, but denied that privilege to businesses that sought patient files merely for marketing purposes. Clinton changed the first rule after pressure from the AMA, the American Psychiatric Association and more than 52,000 letters from doctors and patients. But while Clinton hailed his new position on the issue of HMOs reading medical records, he concealed his 180 on the question of marketing.

After declaring that the new regs "make medical records easier to see for those who should see them, and much harder to see for those who shouldn't," Clinton added: "There's something else that's really bothered me too, for years, and that is that private companies should not be able to get hold of the most sensitive medical information for marketing purposes. ... Recently, expectant mothers who haven't even told their friends the good news are finding sales letters for baby products in their mailboxes. That's also wrong. And under these new rules, it will also be illegal."

But under those new rules, it's not illegal. The only option patients have under the new regulations is to tell marketers, after the marketer has solicited the patient, that they do not want their name on the marketer's solicitation list. Of course, once the marketer has solicited the patient, the damage to privacy has already been done--the patient's medical information has already been seen by unwelcome third parties.

Meanwhile, the spinmeisters for the HMO industry are claiming that the patient-consent requirement will raise premiums and damage the alleged ability of HMOs to improve medical care. "The regs will result in more paperwork and higher co-payments and premiums," declared Mary Grealy, president of the Healthcare Leadership Council, a trade group representing health insurance companies, hospital chains and drug companies. At a press conference on December 20, Karen Ignagni, president and CEO of the American Association of Health Plans (AAHP), the HMO industry's trade group, claimed the consent requirement would "unintentionally jeopardize care" by making it harder for HMOs to do those wonderful disease-prevention activities they claim to do so well, such as reminding women to have a mammogram.

Ignagni did not explain why it should be so difficult for doctors to get their patients to give them permission to send their names to an HMO for the limited and benign purpose of sending them reminder letters when it's time to have a mammogram or an immunization. Most patients would probably agree to such a limited invasion of their privacy. The real reason the HMO industry is upset with the patient-consent requirement is that HMOs want to continue their habit of commandeering patient files to curtail the use of medical services, and the industry knows that the patient-consent requirement will make this habit difficult to sustain.

The new administration's decision to reconsider the Clinton privacy regs would be encouraging if this administration had shown some genuine interest in patient privacy and a lot less interest in groveling before the HMOs. But Thompson is reviewing the regs because the HMO industry asked him to. In a speech on February 26 to representatives of the AAHP, Thompson regurgitated Ignagni's arguments. "Our greatest concern is that these regulations not unwittingly block needed care," he said solemnly.

If Thompson, or ultimately Congress, revises the regs to eliminate the requirement that HMOs get patient consent, but maintains the right of marketers to see records without consent, we will then have the worst of all possible worlds--no patient control over who sees our records and the formal endorsement of this awful status quo by the federal government.

Kip Sullivan sits on the steering committee of the Health Care Campaign of Minnesota.