With the Department of Health and Human Services (HHS) in the midst of a 30-day comment period on proposed clarifications and modifications to the federal privacy rule and Senator Edward M. Kennedy (D-Mass.) chairing an April 16 hearing on the rule, a survey released today by the California HealthCare Foundation (CHCF) shows that most health care organizations in California have developed plans for meeting the April 2003 compliance deadline. However, implementation progress varies across hospitals, health plans, physician groups, and other types of health care organizations.

CHCF will present the results of the survey before the Senate Health, Education, Labor, and Pensions Committee, which Senator Kennedy chairs, on April 16.

"The findings show that to implement the privacy rule successfully, a number of clarifications and modifications are still needed to address areas of confusion and misinterpretation, and to make the rules more workable," said Sam Karp, CHCF chief information officer. "The survey provides evidence that implementation progress is being made, so to remove key provisions of the rule now does not seem justified."

The intent of CHCF's survey is to document the real, rather than perceived, implementation challenges health care organizations are experiencing to help inform policymakers as they consider modifications to the rule.

The survey of 100 health care organizations that do business in California found that, some 14 months before the compliance date, 81% of organizations had developed a strategic plan for compliance and just over half had begun developing and implementing readiness initiatives. As of January and February 2002, when the survey was fielded, 12% reported completing readiness initiatives. Hospitals had made the most progress; physician groups reported the least progress.

The survey, conducted for CHCF by the National Committee for Quality Assurance (NCQA) and the Georgetown University Health Privacy Project, examined how implementation efforts are proceeding under the privacy rule issued by HHS in December 2000. The privacy rule established the first-ever national standards for safeguarding the privacy of individually identifiable health information.

"The need for privacy and confidentiality is only going to grow as more medical records become electronic," said NCQA President Margaret E. O'Kane. "The survey findings show the complexity of this effort, and the importance of developing rules that both respect the need for privacy and allow quality improvement activities to proceed unencumbered."

Other key findings include:

• 81% reported their organization had developed a strategic plan for compliance.
• 52% reported having started to develop and implement readiness initiatives.
• 12% reported having completed implementing readiness initiatives.
• Hospitals have made the most progress to date.
  The consent requirements are "somewhat workable."
• 51% reported the consent requirements were somewhat workable.
• 29% reported the consent requirements were workable or very workable.
• 20% reported they were less than workable or not workable at all.
• Respondents who had developed a strategic plan, conducted a gap assessment, or developed or completed a readiness initiative were more likely than their counterparts to report that the consent requirements were workable.
  The minimum necessary requirements are "somewhat workable."
• 58% reported that the minimum necessary requirements are somewhat workable.
• 20% reported that the minimum necessary requirements were workable or very workable.
• 22% reported they were either less than workable or not workable at all.
  Information needed for quality assessment may be limited by the consent and minimum necessary requirements.
• 58% thought the consent requirements would somewhat or greatly limit the flow of information needed to assess quality of care.
• The survey found a general lack of clarity about the permissibility of disclosures for quality assessment purposes.
  Compliance efforts are not fully funded.
• More than half said their compliance efforts were only partially funded or not funded at all.
  There is a general need for clarifications and/or modifications.
• 78% of respondents thought that HHS needed to provide clarifications or make modifications to the privacy rule.
• Areas where respondents requested clarification included consent, minimum necessary, the definition and rules concerning business associates, rules concerning communications, marketing and funding, and preemption.

  "We are gratified that survey respondents supported the privacy rule's fundamental goals: to foster patient trust in the health care system and enable patients to understand how their personal health information is being used," said Janlori Goldman, director of the Health Privacy Project.

  The complete survey report, an executive summary, the survey instrument, and a list of survey respondents are available on the CHCF Web site through the link below.

  The California HealthCare Foundation (CHCF), Oakland, is an independent philanthropy committed to improving California's health care delivery and financing systems. Through its Health Privacy Initiative, CHCF funds a number of efforts aimed at protecting the confidentiality and security of health information, including monitoring HIPAA implementation and helping organizations understand its requirements. Recent publications include Implementing the Federal Health Privacy Rule in California and HIPAA Administrative Simplification: Tool Kit for Small Group and Safety-Net Providers, which are available for download.

  The National Committee for Quality Assurance (NCQA) is a private, nonprofit organization dedicated to improving health care quality. NCQA accredits and certifies a wide range of health care organizations and manages the evolution of HEDIS, the performance measurement tool used by more than 90% of the nation's health plans. NCQA is committed to providing health care quality information through the Web and the media in order to help consumers, employers and others make more informed health care choices.

  Founded in 1997, the Health Privacy Project at Georgetown University provides a broad array of healthcare stakeholders with the information and tools they need to work more effectively toward greater protection of health information through cutting-edge research studies, policy analyses, Congressional testimony, extensive work with the media, and a Web site.