The Department of Health and Human Services (HHS) released final rules governing the confidentiality of patient electronic medical records on August 9. The rules, first issued by the Clinton administration in the last month of his presidency, were scaled back by the Bush administration before being reissued in final form.

Under the new rules, patient records may not be disclosed to employers without their permission. Patients may also review their records and request factual changes to correct errors.

The new rules omit a provision included in the Clinton proposed rules that would have required a patient's written permission before being handled by medical providers, pharmacies, and health insurance plans. Instead, the new rules require patients to be informed of their privacy rights by those who handle their records. A key exception is carved out for law enforcement agencies, which may access health records without patient permission or notification.

"The rule protects the confidentiality of Americans' medical records without creating new barriers to receiving quality health care," said HHS Secretary Tommy Thompson. "It strikes a common sense balance by providing consumers with personal privacy protections and access to high quality care." 

The rules take effect April 14, 2003. They will not override state laws that are more stringent.

- 8/9/02