the current status of the rules

While press advocates would love to see many portions of the new medical privacy rules go away, lawsuits and lobbying from groups other than the news media threaten to bring the new regulations down.

Health privacy advocates say the White House itself already has destroyed the rules by clipping an important consent requirement and loosening restrictions on how pharmacies, hospitals and drug companies use such information for marketing purposes.

"None of these changes will improve patient care or lower barriers to care; in fact, they will do just the opposite," wrote Janlori Goldman, director of the Health Privacy Project at Georgetown University, in a letter to the New York Times. "Consent is central to fostering trust and confidence in the health care system."

But Republican leaders in Congress have attacked the regulations sparked by the federal Health Insurance Portability and Accountability Act of 1996, saying they might cause more harm than good to medical privacy rights. House Majority Leader Dick Armey, in particular, has been a leading critic of the measure.

"It is not entirely clear to me how the new rules will actually address real medical privacy harms currently suffered by patients not already covered by tort law or other remedies," Armey (R-Texas) wrote last year to Tommy Thompson, secretary of the Department of Health and Human Services. "The proposed HIPAA regulations, however, may actually have the opposite effect, putting private personally identifiable information at a greater risk than exists today."

Thompson later responded, offering considerable changes to the rules.

The new proposal repeals one particularly significant provision of the original Clinton administration rules. That provision dropped a requirement that doctors, hospitals and other health care providers obtain written consent from patients before using or disclosing medical information for treatment or insurance payments.

Thompson said the consent requirements possibly could delay care.

Proponents for health privacy denounced the change, saying it effectively guts the privacy rules.

Although the rules do not go into effect until April 14, 2003, several medical groups have already challenged their legitimacy in court.

On June 17, a federal court in Houston dismissed a lawsuit brought by the Association of American Physicians and Surgeons challenging the validity of the privacy rules. Specifically, the group claimed that the HHS exceeded its authority in regulating health information.

The court dismissed the group's claims, saying that the issues it raised were not ripe for judicial review and that its members had not suffered actual or imminent injury. In the meantime, the court ruled, the group lacks standing to challenge the rules in court.

The South Carolina Medical Association has also challenged the rules, contesting the legality of delegating a legislative authority to the HHS. The courts have yet to hear arguments in that case.

Congress could craft its own privacy standards. But that appears unlikely. The HIPAA authorized Congress to create such rules year ago, but members could never agree on a standard. The law instructed the HHS secretary to take the project in the absence of congressional action. The Clinton administration first offered the rules in October 1999.

In the meantime, a cottage industry has sprung up to help hospitals comply with the law. Such companies offer services to track compliance with the privacy rule, aid in the creation of privacy panels or institutional review boards and perform risk assessment to compare current practices with the HIPAA directives.

The work of such boards, press advocates fear, would only build and strengthen walls separating the public from the medical information it needs.