COVER STORY

FOR YOUR EYES ONLY

Federal patient privacy rules will change how providers handle protected information

Could April 14, 2003, be the new Y2K? That's the day sweeping new federal regulations protecting confidential health information will take effect. Y2K (Jan. 1, 2000, in case you've forgotten) was either an overblown media-driven doomsday scenario that didn't even make the lights flicker or a worldwide disaster averted thanks to years of toil by computer-savvy saviors—take your pick.

All we know now about April 14, 2003, is that on that date a pharmacist or technician will not be permitted to fill certain prescriptions until the patient signs a consent form. The requirement is one of a host of actions wrought by the Health Insurance Portability & Accountability Act (HIPAA), enacted six years ago but only now being detailed in regulation.

HIPAA represents a national standard designed to fill in the gaps in the current patchwork of state privacy and confidentiality laws. The preparation ban covers those prescriptions phoned in by a physician, transferred from another pharmacy, or brought in by someone other than the patient or a legal guardian.

Many pharmacy groups and other healthcare providers view the written consent as a prescription for turmoil. CVS Corp. official Carlos R. Ortiz, R.Ph., predicted there would be "chaos at our pharmacy counters," which are already buckling under the strain of pharmacist shortages and skyrocketing prescription volumes.

There are other concerns as well in the 1,500 pages of ever-dense "bureaucratese." The rules require "covered entities," such as pharmacies and hospitals, not to disclose more information than the "minimum amount necessary" for any purpose other than treatment.

What happens, say, when one insurance company requires pharmacies to submit five fields of information and another company just three fields? "The pharmacy is the one that gets dinged," said Brian Gallagher, the former director of pharmacy regulatory affairs for the National Association of Chain Drug Stores and now general counsel for the pharmacy software firm TechRx Inc.

"Pharmacies are given a Hobson's choice," said Gallagher. If they have to provide five fields to company A to get paid, he explained, but company B can get by with only three fields, hasn't the pharmacy exceeded the minimum necessary standard by sending five? "That's going to be a nightmare if it's not fixed," he told Drug Topics.

Internal server error