H.R. 6898

On September 15, the House Ways and Means Health Subcommittee introduced the Health-e Information Technology Act of 2008 (H.R. 6898). This bill is a significantly revised version of the PRO(TECH)T Act of 2008" (H.R. 6357) reported out of the House Energy and Commerce Committee in July. APsaA representatives were consulted by Health Subcommittee staff on several occasions and submitted detailed legal and policy analyses and suggestions regarding the bill.

The Health-e Information Technology Act has some additional privacy measures suggested by APsaA but also reduces or eliminates other privacy protections that are in the PRO(TECH)T Act. However, the Health-e IT bill is so different from the PRO(TECH)T Act that it is unlikely that there will be time before the Congressional recess for the November elections for the House to reconcile the differences and produce a single bill.

Currently, Congress is adjouned for the elections. There has been no resolution of the privacy concerns raised by Senator Snowe with respect to the Wired for Health Care Quality Act (S.1693) pending in the Senate. So it is likely that a health IT bill will await passage by a new Congress.

It is important, however, for APsaA members to understand some of the key differences in the Health-e IT bill. The bill does not expressly preserve the psychotherapist-patient privilege at the state and federal levels as does the PRO(TECH)T Act. The Health-e IT bill also eliminates the consent requirements for disclosure of identifiable health information in the PRO(TECH)T Act and substitutes a narrower authorization provision.

The Health-e IT bill includes a provision suggested by APsaA that "minimum necessary" determinations are to be made by the disclosing entity (such as the psychotherapist). The bill also includes APsaA's recommendation that HIT standards can only be issued after a rulemaking proceeding allowing for public comment. The bill also retains the provision from the PRO(TECH)T Act allowing individuals to pay privately and not have their health information disclosed for payment or health care operations purposes (but it could still be disclosed for treatment).

The Health-e IT Act generally weakens the privacy protections that are in the PRO(TECH)T Act but provides more and tougher penalties for violations of the privacy protections that are included. The bill does not define the term "privacy" even though it is used throughout the bill nor does it recognize the individual's right to privacy. The bill generally does not take into account that health IT systems pose an unprecedented threat to health information privacy that is essential for quality psychotherapy.

According to latest statistics, the privacy of more than 42 million electronic health records has been violated or compromised in the past three and half years. As a recent report from the Government Accountability Office noted, health information technology has the potential to improve the quality of health care, but it poses an increased threat to health information privacy. Hopefully, a new Congress will appreciate this threat to quality health care.