­Academy Supports Bolstered Privacy Protections

“Without appropriate protections, patients may refrain from sharing their full health history with their primary care physician, including in emergency situations, out of fear of inappropriate use or disclosure of their personal health information,” the Academy said in a May 31 letter to HHS. “The AAFP is extremely concerned that PHI will be used to target patients, their families and their physicians.”

The proposed rule, published April 17 in the Federal Register, notes that HHS, the Federal Trade Commission and the Department of Defense have together determined that reproductive health information is “particularly sensitive and requires heightened protections.” The rule would specifically prohibit sharing PHI related to lawfully provided reproductive health services for criminal, civil or administrative investigations against any person connected with those services. It also would require an attestation, before sharing PHI, affirming that any such requests are not for prohibited purposes.

The AAFP said the proposed rule should extend to other types of highly sensitive health care and called for HHS to clearly define the services gaining protections.

The Academy’s support for this HIPAA fortification is in line with existing and evolving AAFP policy on patient privacy and the confidential relationship between patient and physician.

During the National Conference of Constituency Leaders last month, delegates adopted a substitute resolution asking the AAFP to update its policy against criminalization of evidence-based medical practice to specify that it applies to “criminalization of clinicians, patients and those who aid patients in receiving reproductive, abortion or gender-affirming health care across state lines.” Another substitute resolution asked for resources to help members protect themselves against legal claims and/or to allow them to continue to safely provide care to LGBTQI+ patients and their families. 

The AAFP’s letter further urged HHS to

• work with electronic health record vendors to modernize the functionality of health care data management platforms to comply with this proposed rule without adding cost or complexity to physician practices,
• make resources available to assist physicians and other clinicians in understanding their rights and how to respond to contradictions between state laws and this proposed rule and
• make information widely available to patients about their PHI rights. 

On this last point, the Academy lauded the proposed rule’s reaffirmation of patients’ rights to request their own PHI and its stipulation that this right of access may not be denied under the proposed protections.

“The AAFP agrees that a patient’s right to their PHI is necessary to promote shared decision making between a patient and physician and that this right is paramount to the proposed protections,” the letter said. Beyond this, the letter added, HHS should “make information widely available about a patient’s rights regarding requesting and sharing their PHI with other entities and the right to decline to do so.”