WHEN PRIVACY KILLS

Rights to privacy usually are a good thing. Except when they kill.

Unnecessary deaths will almost certainly be the result of medical privacy regulations implemented in April by the Department of Health and Human Services, pursuant to the Health Insurance Portability and Accountability Act of 1996. These regulations make it a crime for health care workers to disclose "individually identifiable health information" to a third party without the prior consent of the patient involved.

The regulations make no exception for disclosure in response to legitimate newsgathering activities. And they impose draconian penalties equivalent to those faced by experienced drug dealers. As a result, even when the disclosure of medical information is strongly in the public interest — exposing doctors' or health care institutions' crime, fraud or blatant malpractice — such disclosure often will not be made, and the media stories that can act to end dangerous practices will never be written.

In these and other situations, the public interest can sometimes outweigh individuals' privacy concerns. Yet the regulations not only tip the balance always and irrevocably in favor of privacy, they also employ criminal, rather than civil, penalties to ensure that privacy will always win, no matter the cost to the public.

Harsh Penalties, But Little Protest

Under the HIPAA regulations, divulging a patient's health information exposes a health care worker to a felony conviction, a fine of up to $50,000, and up to a year in jail. If the information was obtained under "false pretenses," the fine can be up to $100,000, and the length of imprisonment up to five years. And if a jury finds that the disclosure was motivated by the health care worker's seeking "personal gain," the offense can result in up to ten years in prison and a fine of $250,000.

There is little evidence that preexisting legal protections for medical privacy were inadequate. Yet Washington implemented the new regulations almost entirely without public controversy.

The regulations were first proposed last year by the Clinton administration. After the election, the ACLU and other organizations — emphasizing the current outcry for greater privacy rights — urged President Bush to implement the regulations without delay. Rather than repudiate the regulations, as he did others proposed by his predecessor, Mr. Bush essentially adopted them as his own. In a column this May, William Safire then lauded Mr. Bush as the "Privacy President" for doing so.

Although a number of press organizations objected, their voices were mostly ignored. This is hardly surprising. In a Gallup survey last fall, 78% of those polled felt it "very important" that their medical records be kept confidential.

In short, most people strongly want medical information kept private. In such circumstances, how can anyone oppose tough criminal penalties for hospital workers who share information about their patients with outsiders?

You should. According to a 1999 report by the National Institute of Medicine, at least 44,000 people are killed in any given year by medical errors. History teaches that hospitals and clinics — particularly the few that are so badly run as to be routinely dangerous to their patients — are badly in need of diligent watchdogs.

That is where reporters step in. There is a distinguished tradition of newspapers' exposing systematic incompetence and malfeasance in health care institutions. For example:

• In 1972, the Associated Press broke the story that 399 black men from rural Alabama who signed up for medical care were left untreated for decades as part of a secret government research project. The AP reported that 28 of the men who signed up had died of syphilis, and 100 others had died of syphilis-related complications.

• In 1995, the Orange County Register reported on fraud by fertility doctors at the University of California. In a series that won the Pulitzer Prize, the Register disclosed that at least 60 women were unknowingly involved in illicit transfers of their eggs or embryos to other women, resulting in at least 51 pregnancies. The newspaper's investigation relied on a handwritten name-by-name listing of unconsented-to egg "donations" prepared by a biologist at the fertility clinic.

• This spring, the Seattle Times reported that at least two dozen patients had died prematurely in two failed clinical trials at the Fred Hutchinson Cancer Research Center that used drugs in which doctors at the center had a financial interest. The series relied in part on medical records to show that many more patients in the experimental programs had died than would otherwise be expected.

Important Stories That Depend on Medical Information

Virtually without exception, these and similar shocking stories would never be uncovered if the leads on which they originally were based had required the consent of the patients at issue.

That is because the victimized patients and their families almost never have the ability to see enough of the larger picture to distinguish a doctor's malfeasance from simple bad luck. They may also be reluctant to blame the very doctors they have chosen to care for them. As a result, these stories most often are the product of tips to journalists that come not from patients, but rather from lower-level workers such as orderlies, registration clerks, and hospital volunteers.

Why the Press Is a Better Ombudsman than the Government

Granted, the current regulations do permit hospital whistleblowers to forward their concerns to a "health oversight agency" without fear of criminal penalty. As a mechanism for policing medical misconduct, however, this scheme is wildly unrealistic.

Wrongdoing is rarely uncovered by virtue of an official government submission. And even if whistleblowers do submit tips to the government, legitimate tips most often will face an unsympathetic, poorly funded, or inattentive audience.

Much more typically, medical wrongdoing is exposed only because a hospital staffer talks to a reporter in a bar or at a party. The reporter then does his or her job, pursuing the story until the truth is uncovered.

The Chilling Effect of the Regulations' Criminal Penalties

Will these potentially lifesaving tips still be made to reporters now that doing so is a serious federal crime? In many cases, no. The chilling effects generated by transforming every leak of medical information into a felony will cost real lives in the real world.

Stifling stories about evil and incompetent doctors is not the only way in which the HIPAA's medical privacy regulations work against the public interest. In many other contexts, journalists have for years relied on detailed information from hospital sources to cover stories that everyone agrees are in the public interest.

These stories include, for example, stories about the medical condition of top public officials whose health affects the administration of government. Think of Vice President's Cheney's heart attack in November 2000, which President-elect Bush initially insisted was no such thing.

Also newsworthy are many other breaking stories that involve victims under acute care — including those about natural disasters, bombings and other violent crimes, airplane crashes, environmental hazards, and traffic accidents. In most of these situations, there are dozens (or, in a plane crash or bombing, hundreds) of family members of potential victims who wait in agony for word about the conditions of their loved ones.

Invisible But Real Harms

The harm from these new regulations is not easy to see. It is reflected in potential stories that will never be investigated, and in exposes that will never make it to press. The harm nonetheless is real, and includes a lack of outside scrutiny that will permit the rare doctor who kills to continue killing longer.

The unyielding wall of silence mandated by HIPAA simply is not worth such a price.