|
AHP Letter to HHS Secretary Tommy Thompson See also: HHS Responds to AHP Request or Clarification on the US HIPAA Privacy Rule December 23, 2002 Honorable Tommy Thompson Re: Final Rule on Standards for Individually Identifiable Health Information (Privacy Rule) Dear Secretary Thompson: I am writing on behalf of the 3,300 members of the Association for Healthcare Philanthropy (AHP) seeking clarification on a number of issues relating to the above-referenced subject. AHP is an association of professional development executives who are responsible for the management of the foundations and development departments of nonprofit health care providers throughout the United States. A critical part of their mission is supporting local health care programs through philanthropic fundraising that directly benefits the institutions and communities in which they work. These nonprofit medical facilities approach and have regularly come to rely on the generosity of grateful patients who they have served to help underwrite wellness programs, mobile health vans, mammography screenings, hearing and eye exams, hospital facility improvements, essential equipment upgrades and health care services for the uninsured. As the budgets for health care institutions continue to be stretched and demand for services grows, these providers have come to rely on a certain level of charitable support in annual planning. By approaching grateful patients who have received treatment in the facilities that employ them, AHP members raised more than $8 billion in 2001 which supports these diverse programs. I want to emphasize that these professionals have a relationship to the covered entity that guides their activities and distinguishes them from many others who are engaged in fundraising activities in the health care field—AHP' members are directly employed by the institution. It is AHP's view that this unique relationship and the self-imposed limitations on fundraising activities that come with it should be given consideration in providing our members guidance when interpreting the Privacy Rule. AHP thanks the Department of Health and Human Services for recognizing the importance of philanthropic fundraising in the Privacy Rule by including fundraising activities of nonprofit health care institutions within the definition of health care operations. However, there are a number of points on which our members need clarification so that they may conduct their essential work while continuing to protect the confidentiality of individually identifiable health information as has been their history. AHP has identified three key issues that could impact adversely on the philanthropic fundraising efforts of its members. These are: the use of "Patient Department of Service" (PDS) information in targeting appeals; the need for Business Associate Agreements between a not-for-profit health care institution and its own development office or foundation; and, the ability of physicians and other health care providers who are independent contractors rather than employees of not-for-profit hospitals to make patient referrals to the development office for the purpose of philanthropic fundraising appeals. Patient's Department of Service Information The Privacy Rule recognizes that philanthropic fundraising is a part of health care operations. However, the final rule limits protected health care information to be used or disclosed for fundraising to demographic information and the date of treatment. See Preamble 45 CFR, sec. 164.514(f). Although the rule does define, and therefore limit, what is considered to be demographic information, the Preamble states that the term "will generally include in this context name, address, and other contact information, age, gender, and insurance status. The term does not include any information about the illness or treatment." AHP believes that the Privacy Rule would be strengthened by allowing development office employees of not-for-profit hospitals and the foundations that own those hospitals to have access to one additional piece of information that in the health care world is essentially demographic in nature: their patients' department of service (PDS). This information, which has historically been accessible to development offices (predating AHP's founding 37 years ago) and the use of which is strictly governed by AHP's Statement of Professional Standards of Conduct and Donor Bill of Rights, is critical to efficient fundraising appeals. It has been AHP's experience that patients, family and friends who have been provided care for a specific health concern often have a strong emotional tie to treatment and research in that area. As a result, they will be much more receptive to a fundraising campaign for programs targeted to that health care concern than others. For example, the regulations as written require that an entity that wants to raise funds to support a cancer center would have to write to all of its patients rather than those who have been touched by that illness. This will necessitate a more costly appeal than one which reaches out to grateful patients directly affected. Further, the Privacy Rule will undermine philanthropic fundraising efforts by teaching hospitals which rely heavily on campaigns targeted to specific health care concerns. In short, without the PDS information relating to its own patients, the Privacy Rule will force the use of a shotgun approach to fundraising which will increase costs and dilute the efficacy of our philanthropic fundraising efforts. AHP asks HHS to issue guidance that allow appropriate individuals access to information relating to the generic area of treatment. Business Associate Agreements The development offices of and foundations that own not-for-profit hospitals fall under the definition of health care operations. See, sec. 164.501. However, out of an abundance of caution, a very few health care institutions are interpreting the Privacy Rule as possibly requiring Business Associate Agreements with their own development offices or foundations. The rule itself does not explicitly exclude these entities from its purview. It is AHP's view that such agreements are not required. The institutionally related foundations linked to the health care provider established formal relationships (through their By-laws and Articles of Incorporation) that effectively serve the purpose of the Business Associate Agreement under the Privacy Rule. Further, in a number of critical instances, the Privacy Rule makes a distinction between a "business associate" and an "institutionally-related foundation" suggesting that the two are to be treated differently. See, 45 CFR 164.514(f)(1): "A covered entity may use, or disclose to a business associate or to an institutionally related foundation, the following..." There are numerous references in the Preamble to the regulations which support this position. AHP believes that these agreements were not envisioned by the Privacy Rule. However, absent a clear reference in the regulations, AHP'seeks clarification on this point. Medical Independent Contractor Referrals Currently, physicians and nurses may refer the names of grateful patients to the health care institution's development office. However, physicians and other medical personnel are often contractors (on staff) to the institution rather than its employees. As written, it is unclear whether the Privacy Rule allows a physician or other health care provider who is not an employee to make such a referral. The term "disclosure" is defined as "the release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information." Sec. 164.501. Thus, it could be argued that an independent contractor physician, being outside the entity, may not make such a disclosure to the hospital's development office. A similar communication by an employed physician or other employee would not be a disclosure since as an employee they would be inside the entity. This appears to be an unintended result of the Privacy Rule. There is a special relationship between members of a hospital's medical staff and the institution itself—regardless of whether the personnel are employees or contractors. AHP believes that it is the intent of the Rule as it relates to referrals and fundraising that employed health care providers as well medical independent contractors were intended to be able to refer the names of grateful patients to the development office for fundraising purposes. AHP'seeks guidance on this issue. With a compliance date of April 14, 2003, I request guidance as soon as possible. Thank you for your consideration. I would be pleased to provide HHS with any additional information you request or to meet with appropriate staff at your convenience. Very truly yours,
|
