The Federal Trade Commission announced last week its full support of privacy protection guidelines proposed by the U.S. Department of Health and Human Services.
Although the announcement appears to further signify the FTC’s growing role in managing public policy issues relating to consumer privacy, Ari Schwartz, policy analyst with the Center for Democracy and Technology, believes it shouldn’t come as a surprise to most in the healthcare business community. “The FTC always said that health records would be part of their main concern,” he said.
The statement released by the FTC said standards recommended by the HHS “are strongly supported by the Federal Trade Commission.” The department also said it “intended to support provisions” for “individual authorization” or “opt-in” approaches that would lead to the ancillary use of such information for purposes other than those for which the data was originally collected.”
But the FTC’s analysis of the HHS rules did outline stricter guidelines that it hoped HHS would consider in terms of disclosure requirements for consumers via two proposed documents – the General Notice and the Model Authorization form.
The first HHS rule requires that covered entities obtain advance written “individual authorization” before they use or disclose individuals’ protected health information for any purpose other than healthcare treatment, payment, or healthcare operations.
“We believe,” the FTC stated, “that this opt-in, or express consent, requirement is the most appropriate approach for the use of sensitive medical information for purposes other than those for which it was collected.”
The FTC also noted in its comment that it has considerable experience in addressing deceptive healthcare practices and privacy and consumer protection issues.
“Like personally identifiable information about children, personal medical information is among the most sensitive types of information collected from individuals,” the comment explained, and “… consumers are most troubled by the prospect of unauthorized disclosure of medical information.” In addition, the FTC offered suggestions to the HHS relating to how information is described and how it will be used.
According to the FTC’s comment, some portions of “limited disclosure may not adequately inform consumers of the actual, intended use of the information,” and “… might encourage or permit covered entities to use broad or vague language to describe the purpose of a requested use or disclosure.”
The comment noted that the disclosure should describe the intended uses “in sufficient detail to put the individual on notice of the uses and disclosures expected to be made of his or her protected health information.” This standard helps ensure that individuals understand what uses and disclosures will be made of their sensitive health information. “Such understanding is crucial to ensure that individuals make informed choices about how their health information is used,” the FTC said.
