Hostname: page-component-cd9895bd7-p9bg8 Total loading time: 0 Render date: 2024-12-27T12:28:09.472Z Has data issue: false hasContentIssue false
  • English
  • Français

Direct Contracts, Data Sharing and Employee Risk Selection: New Stakes for Patient Privacy in Tomorrow's Health Insurance Markets

Published online by Cambridge University Press:  24 February 2021

David M. Studdert
David M. Studdert*
Affiliation:
RAND Institute for Civil Justice and RAND Health; University of Melbourne; Harvard School of Public Health
Get access Rights & Permissions [Opens in a new window]

Extract

The central storage and easy accessibility of computerized data vastly increase the potential for abuse of that information, and I am not prepared to say that future developments will not demonstrate the necessity of some curb on such technology.

—Justice William Brennan

In the decades since the United States Supreme Court’s consideration of informational privacy in Whalen v. Roe, a couple of worthy candidates to fulfill Justice Brennan's premonition of “future developments” have emerged. One is the nature of information technology itself. Today, sensitive health care data are generated, stored, transferred, and deployed toward countless uses with astonishing facility. An inexorable shift toward computerized medical records and fully automated storage and transfer of patient information is well underway.

Type
Articles
Information
American Journal of Law & Medicine , Volume 25 , Issue 2-3: Electronic Medical Information: Privacy, Liability & Quality Issues , 1999 , pp. 233 - 265
Copyright
Copyright © American Society of Law, Medicine and Ethics and Boston University 1999

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

1 See Whalen v. Roe, 429 U.S. 589, 607 (1977) (holding that a New York statute requiring the state to obtain and record in a centralized computer system the name, address, and age of persons who obtain prescriptions for certain dangerous drugs does not invade privacy rights under the 14th Amendment).

2 See Committee on Improving the Patient Record, Institute of Medicine, the Computer-Based Patient Record: an Essential Technology For Health Care 4, 136 (Richard S. Dick & Elaine B. Steen eds., 1991) [hereinafter IOM I] (recommending that the computer-based patient record be adopted as the standard for medical and all other records related to patient care); Committee on Maintaining Privacy & Security in Health Care Applications of the National Information Infrastructure, National Research Council, for the Record: Protecting Electronic Health Information 25 (1997) [hereinafter National Research Council] (reporting that 56% of hospitals were investing in electronic medical records in 1995 and that the market is projected to grow into a $1.5 billion industry by 2000); Lawrence O. Gostin, Health Information Privacy, 80 Cornell L. Rev. 451, 456-70 (1995) (summarizing advances leading to the proliferation of electronic medical record systems) [hereinafter Gostin I].

3 See Whalen, 429 U.S. at 605, 607.

4 Id. at 593.

5 See 1998 N.Y. Laws 537. See also New York State Department of Health, Bureau of Controlled Substances, New York State's New Controlled Substance Law (visited Apr. 26, 1999) <http://www.health.state.ny.us/nysdoh/newlaw.htm>.

6 See New York State Department, supra note 5.

7 See Jon Gabel et al., Employer-Sponsored Health Insurance in America, Health Aff., Summer 1989, at 116, 117, 126-27 (noting premium increases of 12% between 1987 and 1988, nearly double the rate of increase from the previous year); Cynthia B. Sullivan & Thomas Rice, The Health Insurance Picture in 1990, Health Aff., Summer 1991, at 104, 114 (finding that 75% of employers are satisfied with their health plans, while only 57% are satisfied with the cost of the health plans).

8 See Troyen A. Brennan & Donald M. Berwick, New Rules: Regulation, Markets, and the Quality of American Health Care 150-65 (1995) (summarizing the growth of health maintenance organizations and federal and state legislation).

9 See generally James C. Robinson, Health Care Purchasing and Market Changes in California, Health Aff., Winter 1995, at 117;. James C. Robinson & Lawrence P. Casalino, Vertical Integration and Organizational Networks in Health Care, Health Aff., Spring 1996, at 7 (evaluating two forms of organization: virtual integration and vertical integration).

10 See James C. Robinson, The Future of Managed Care, Health Aff., Mar.-Apr. 1999, at 231; Robinson & Casalino, supra note 9, at 7. See generally Stephen M. Shortell et al., Remaking Health Care in America: Building Organized Delivery Systems (1996) (discussing the movement toward functional, physician, and clinical integration of managed care organizations).

11 See Gail A. Jensen et al., The New Dominance of Managed Care: Insurance Trends in the 1990s, Health Aff., Jan.-Feb. 1997, at 125, 126; Katharine R. Levit et al., National Health Spending Trends In 1996, Health Aff., Jan.-Feb. 1998, at 43 & n.20; Tudor et al., Satisfaction With Care: Do Medicare HMOs Make a Difference?, Health Aff., Mar.-Apr. 1998, at 165, 166.

12 See National Research Council, supra note 2, at 21-24.

13 See Committee on Regional Health Data Networks, Institute of Medicine, Health Data in the Information Age: Use, Disclosure, and Privacy 140-41 (Molla S. Donaldson & Kathleen N. Lohr. eds., 1994); National Committee on Vital & Health Statistics, Department of Health and Human Services, Health Privacy and Confidentiality Recommendations (visited May 19, 1999) <http://aspe.os.dhhs.gov/ncvhs/privrecs.htm> (see Part B entitled “Technology and Identifiable Information”). I use the term privacy in this discussion to refer generally to the notion of nondisclosure of personal information. See Committee on Regional Health Data Networks, supra, at 15. Confidentiality refers to nondisclosure of personal information generated in the context of a fiduciary relationship, such as the health care professional-patient relationship. See id. at 16.

14 The Balanced Budget Act of 1997 defines provider-sponsored organization (PSO) as:

  1. (1)

    (1) [A] public or private entity

  1. (A)

    (A) that is established or organized, and operated by a health care provider or group of affiliated health care providers,

  2. (B)

    (B) that provides a substantial proportion … of the health care items and services directly through the providers or affiliated group of providers, and

  3. (C)

    (C) with respect to which the affiliated providers share, directly or indirectly, substantial financial risk with respect to the provision of such items and services and have at least a majority financial interest in the entity.

The Balanced Budget Act of 1997, Pub. L. No. 105-33, § 4001, 111 Stat. 251,316. With the exception of “substantial financial risk" as a defining feature (a provider-sponsored entity need not necessarily assume such risk to qualify as a PSO), this definition is sufficiently broad to serve as a useful reference.

15 See National Association of Insurance Commissioners, the Regulation of Risk-Bearing Entities 1-17 (1997) [hereinafter NAIC].

16 The term health plan or plan in this discussion refers to the discrete corporate entity in health insurance markets that contracts both with individual/group purchasers and providers for the delivery of care and issues insurance policies to enrollees or subscribers. The prototypical health plan is the HMO.

17 See Alan Hillman et al., Contractual Arrangements Between HMOs and Primary Care Physicians: Three Tiered HMOs and Risk Pools, 30 Med. Care 136, 137 (1992).

18 See Douglass J. Seaver & Stephen H. Kramer, Direct Contracting: The Future of Managed Care, Health Care Fin. Mgmt., Aug. 1994, at 20, 21.

19 This division reduces transfer costs and redundant systems costs. See id.

20 See id. at 22-26. See generally James J. Unland, The Emergence of Providers as Health Insurers, J. Health Care Fin., Fall 1996, at 58 (discussing why providers have begun to assume risk); James J. Unland, The Range of Provider/Insurer Configurations, J. Health Care Fin., Winter 1998, at 12 (discussing the limitations of the traditional physician-hospital organization (PHO) model).

21 See Seaver & Kramer, supra note 18, at 23-24.

22 See id. at 24.

23 See id.

24 See Eastern Health Care Consortium, Direct Contracting Issues and Opportunities 15 (Sept. 1991) (discussing a survey of medium and large hospitals and hospital networks and systems regarding various aspects of direct contracting, including sales, budget payment arrangement and revenues).

25 See id. at 24.

26 See id.

27 See id. at 22-26.

28 See Dan Wise, Private Matters, Bus. & Health, Feb. 1995, at 22, available in Westlaw, BUSHLTH database (discussing privacy issues surrounding employers' adoption of wellness and employee assistance programs (EAPs)). For analysis of a decline in employers' use of EAPs for mental health and substance abuse in the 1990s, see generally Jeffrey A. Buck & Beth Umland, Covering Mental Health And Substance Abuse Services, Health Aff., July-Aug. 1997, at 120.

29 See generally Donna Diblase, Direct Ties with Providers Can Cut Health Care Costs, Bus. INS., June 26, 1989, at 121 (stating that direct contracting provides significant benefits to both parties including control of health care costs); Julie Johnsson, Direct Contracting: Employers Look to Hospital-Physician Partnerships to Control Costs, Hospitals, Feb. 20, 1992, at 56 (concluding that “the best way to create long-term benefits savings is by eliminating third parties like Hmos and [preferred provider organizations] ….”); Julie Johnsson, Direct Contracting: Hospitals Discover its Risks and Rewards, Hospitals, May 20, 1990, at 40 (stating that employers are frustrated by the inability of intermediaries to control health care costs); Paul J. Kenkel, Direct Contracting: A Recipe for Savings, Modern Healthcare, Oct. 15, 1990, at 24 (same); Nellie O'Gara, Hospitals Should Pursue Employer Contracts, Hospitals, Dec. 5, 1990, at 64 (providing suggestions for an efficient direct contracting approach); Alden Solovy, Cutting out the Middlemen, Hospitals, NOV. 20, 1988, at 52, 52 ("Imagine them gone … [n]o one between the hospital and the purchaser.”).

30 See Alden Solovy & Reid Sunseri, Leading the Way, Hosp. & Health Networks, Aug. 1998, at 30, 30.

31 See id. A 1998 survey of 700 health care executives conducted by the 1998 Hospitals & Health Networks Leadership Survey group asked respondents to rate the importance of 30 issues on a five-point scale as well as the respondents' preparedness to deal with the issues. See id. Direct contracting received a moderate score for importance (3.02), on a l-to-5 scale (ranging from extremely unimportant to extremely important) and a lower score (2.56) for preparedness to deal with this issue. See id. Investigators concluded that this was an area where a “strategic gap" existed (i.e. the gap between an issue's importance and the organization's ability to handle the issue. See id.

32 See id.

33 Jon B. Christianson, The Role of Employers in Community Health Care Systems, Health Aff., Jul.-Aug. 1998, at 158, 162.

34 Uncertainty and debate persist about the relationship between state insurance regulation and risk-bearing PSOs. See Allison Overbay & Mark Hall, Insurance Regulation of Providers that Bear Risk, 22 Am. J.L. & med. 361, 361 (1996). One issue in the debate has been whether conventional HMO-style insurance regulation of risk-bearing PSOs is warranted in instances where they merely assume downstream risk. See id. at 372. The National Association of Insurance Commissioners (NAIC) has recommended against insurance regulation in such circumstances, preferring instead to regard downstream risk assumption as merely a form of service subcontract. See id. In addition, NAIC notes that “[b]oth the provider community and traditional players in the managed care market seem to agree that PSOs which contract with licensed insurers to provider services on a risk basis should not be subject to licensure requirements that are as strict as those imposed on HMOs." NAIC, supra note 15, at 1-24, 1-25. See Witten, Douglas J., Regulation of “Downstream" and Direct Risk Contracting by Health Care Providers: The Quest for Consumer Protection and a Level Playing Field, 23 Am. J.L. & Med. 449, 470 (1997)Google Scholar (stating that licensure requirements of PSOs that contract downstream from licensed entities should be less strict than those that contract with upstream entities). A more contentious issue involves whether, and to what extent, PSOs that engage in direct contracts should be subject to the type of insurance regulation imposed on HMOs and other health carriers. See id. at 465-66. Provider representatives and some employers have argued that such an approach is unduly insensitive to organizational differences in the provider model and that such heavy-handed insurance oversight stifles growth in this important area. See id. at 466; NAIC at 1-17, 1-18. HMOs and other established insurers argue that special treatment of risk-bearing PSOs that enter direct contracts confers unfair market advantages on such entities, and raises solvency and quality of care concerns. See id. There now appears to be reasonably broad agreement that risk-bearing PSOs engaging in direct contracting spread risk in a manner consistent with McCarran-Ferguson criteria defining the “business of insurance," and as such should be subject to state insurance regulation. See Witten, supra, at 459, 468. However, states have adopted different positions on whether the same regulations as are applied to more conventional health insurance carriers are appropriate. See infra note 117.

35 See Overbay & Hall, supra note 34, at 369-74.

36 See id. at 366.

37 See Arizona v. Maricopa County Med. Soc'y, 457 U.S. 332, 348-55 (1982) (stating that the rule is violated by “a price restraint that tends to provide the same economic rewards to all practitioners regardless of their skill, their experience, their training, or their willingness to employ innovative and difficult procedures in individual cases.”).

38 See Edward Hirshfeld, Interpreting the 1996 Federal Antitrust Guidelines for Physician Joint Venture Networks, 6 Ann. Health L. 1, 11 (1997).

39 See id. at 11-12.

40 See Overbay & Hall, supra note 34, at 367.

41 See U.S. Department of Justice & Federal Trade Commission, Guidelines and Policy Statements (visited Apr. 26, 1999) <http://wwhttp://www.usdoj.gov/atr/public/guidelines/guidelin.htmw.usdoj.gov/atr/public/guidelines/guidelin.htm>.

42 Overbay & Hall, supra note 34, at 366.

43 See generally Robinson & Casalino, supra note 9.

44 See Robert S. Galvin, Part II: What Do Employers Mean By Value, Integrated Healthcare Report, Oct. 1998, at 5-6 (stating that employers “have not been helpful," striving for short-term gains rather than long-term strategies for controlling costs and improving quality).

45 See Congressional Budget Office, the Economic and Budget Outlook: Fiscal Years 1998-2007, CBO Projections of National Health Expenditures Through 2007, App. H, 125 (1997); Sheila Smith et al., The Next Ten Years of Health Spending: What Does the Future Hold?, Health Aff., Sept.-Oct. 1998, at 128, 128 (“… the higher anticipated growth in real per capita national health spending will be driven almost entirely by rising expenditures in the private … sector.”); Stephen Barr, U.S. Employees Face 8.5% Rise in Health Bill, Wash. Post, Sept. 27, 1997 at Al, Al. But cf. Paul B. Ginsburg & Jon R. Gabel, Tracking Health Care Costs: What's New In 1998?, Health Aff., Sept.-Oct. 1998, at 141 (arguing that the much feared upswing in costs is still not as imminent as media reports suggest).

46 See Galvin, supra note 44, at 4.

Unfortunately, [the] HMO solution has turned out to be less than it appeared. The decrease in prices over the past four years has been due almost completely to the off-retailing, or volume discounts, which have been one-time discounts spread out over multiple years ... . There have been some improvements on the quality side as well, but far less than those needed to continuously lower costs.

Id.

47 See Currents, 66 Hospitals, Mar. 20, 1992, at 18, 20.

48 Se e Levit et al., supra note 11, at 35, 41 (citing D. Emmons & G. Wozniak, Physicians' Contractual Arrangements with Managed Care Organizations, in Socioeconomic Characteristics Of Medical Practice 7-20 (1997) & D. Emmons and C. Simon, Managed Care: Evolving Contractual Arrangements, in Socioeconomic Characteristics of Medical Practice 15-25 (1996).

49 See Seaver & Kramer, supra note 18, at 21.

50 See Thomas Bodenheimer & Kip Sullivan, How Large Employers are Shaping the Health Care Marketplace (pts. 1 & 2), 338 NEW Eng. J. Med 1003, 1005-07, 1084-85 (1998); David Knutson, Case Study: The Minneapolis Buyers Health Care Action Group, 35 Inquiry 177, 171-77 (1998).

51 See Bodenheimer & Sullivan, supra note 50, at 1005.

52 See Knutson, supra note 50, at 171.

53 See Bodenheimer & Sullivan, supra note 50, at 1006.

54 See Ron Winslow, Employers Attack on Health Bills Spurs Change in Minnesota, Wall St. J., Feb. 26, 1993, atA9,A9.

55 See Robinow, Ann L., The Buyers Health Care Action Group: Creating a Competitive Care System Model, 5 Managed Care Q., Summer 1997Google Scholar, at 61, 63.

56 See J.D. Kleinke, Employers Can Do it Without Mandates, Wall St. J., Nov. 5, 1994, at A14, A14. (reporting that “[b]y the end of 1993, per employee costs for coalition members were 10% lower than the average HMO premium offered to members previously. In 1993, costs increased only 4% to 5%, half that of the rest of the country.”); Ron Winslow, Employer Group Rethinks Commitment to Big HMOs, Wall St. J., July, 21 1995, at Bl, Bl (reporting that in 1993, “employers' health costs fell 11%; [in 1994] premiums rose, but only with inflation, and costs per employee were 35% lower than the national average”).

57 See Robinow, supra note 55, at 62.

58 See Steven N. Burrows & Robert C. Moravec, Direct Contracting: A Minnesota Case Study, 8 Healthcare Fin. Mgmt., Aug. 1997, at 50, 50; Dan Wise, Direct Contracting Comes to the HMO Heartland, Bus. & Health, Sept. 1993, at 53, available in Westlaw, BUSHLTH database.

59 A care system is defined as “a primary care-centered health system with its affiliated specialty, hospital and allied professional arrangements … organized by physicians, PHOs, health plans or any other entity. Care systems determine their network of providers, their approach to care management and patient flow (e.g. gatekeeper versus open access)." Robinow, supra note 55, at 63.

60 See Knutson, supra note 50, at 171.

61 See id. & See id. at 172-73.

63 In the inaugural round of submissions, bidders were instructed to base targets on the average utilization history of the entire population of the Minnesota Buyers Health Care Action Group (BHCAG). See Robinow, supra note 55, at 63.

64 See Steve Wetzell, Consumer Clout, 79 Minn. Med. 15, 18 (1996) ("For example, if the employer contributes $100 per month and the employee chooses a provider whose claim target is $110, the employee pays $10 per month.”).

65 For a standard patient population, if the care system's claims are lower than the claim target, the fee schedule conversion factor will be high in the next quarter. If the claims are higher than the target, the fee schedule will be lower. See Allan Baumgarten, Virtual Capitation to the Rescue, Bus. & Health, July 1, 1996, at 23, 24.

Suppose, for example, that Care System A looks at its cost of providing care and projects a claim target of $100 pm/pm [per-member per-month]. After open enrollment season ends, the population of BCHAG enrollees in System A is graded on its actual risk profile and the target adjusted accordingly. If System A has a higher-than-average risk, its claim target would be adjusted up to, say, $105 pm/pm; after three to six months, that target would be compared to actual claims experience. If actual claims amounted to $97 pm/pm, for instance, Care System A would get a pat on the back and an upward adjustment in the fees its doctors are paid. However, if claims totaled $110 pm/pm, Care System A would get a slap on the wrist and a proportional reduction in doctors' fees.

Id.

66 See Knutson, supra note 50, at 173. See also Wetzell, supra note 64, at 18 ("Each BHCAG employer will be responsible for whatever shortfalls or surpluses arise when the actual fee-for-service cost of care for their enrollees is different from the BHCAG employer's premium contribution plus the members' premiums.").

67 See Knutson, supra note 50, at 173-74. In seeking to reconcile these conflicting objectives, BHCAG's approach resembles the “blended rate" reimbursement model that Newhouse, a noted health economist, has long advocated. See id.; Joseph P. Newhouse et al., Risk Adjustment and Medicare: Taking a Closer Look, Health Aff., Sept.-Oct. 1997, at 26, 37-40.

68 Personal communication with Ann L. Robinow, Executive Director, Care Systems and Finance, Buyers Health Care Action Group, in Minneapolis, Minn. (Feb. 12, 1999) (discussing experience with and organizational aspects of BHCAG's purchasing and delivery model).

69 See id.

70 See id. See also Glenn Howatt, Health Care Buyers' Coalition Chooses New Administrators, Star Trib., Oct. 26, 1998 at 6D, 6D.

71 See Burrows & Moravec, supra note 58, at 50; Knutson, supra note 50, at 171; Robinow, supra note 55, at 61.

72 See Personal Communication with Ann. L. Robinow, supra note 68. See also Roberto Ceniceros, Calpers Evaluates Direct Contracting, Bus. Ins., Apr. 6, 1998, at 1, 1.

73 See John Manning, BHCAG Enrollees Opt for Lower Price, Higher Satisfaction, Minneapolis/St. Paul City Bus. J., Mar. 6, 1998, at 3, 3.

74 See id.

75 See Glenn Howatt, BHCAG Expects Relatively Small 1999 Price Increase, Star Trib., July 24, 1998, at 3D, 3D.

76 See David L. Coleman, Will Direct Contractors be the Cost and Quality Champs?, Bus. & Health, Mar. 1, 1997, at 38, 38; Harris Meyer, The Tide of Times, Hospitals & Health Networks, Apr. 20, 1996, at 34, 36-40.

77 See Gene Yasuda, Companies Bypass Insurers to Cut Costs, Orlando Sentinel Trib., July 5, 1992, atDl.Dl.

78 See James Maxwell et al., Managed Competition in Practice: Value Purchasing by Fourteen Employers, Health Aff., May-June 1998, at 216, 224.

79 See M. William Salganik, Hopkins Plan Omits Traditional Pieces, Baltimore Sun, April 26, 1996, at 1C, 1C.

80 See Meyer, supra note 76, at 38.

81 See Bill Deener, More Firms Negotiating Directly for Health Care, Dallas Morning News, Jan. 7, 1994, at ID, ID (describing Tom Thumb Food Stores' switch from the North Texas Network to direct contracting).

82 See Allan Baumgarten, The Minnesota Experiment, Bus. & Health, July 1996, at 23, 26.

83 See generally Judith H. Hibbard et al., Can Medicare Beneficiaries Make Informed Choices?, Health Aff., Nov.-Dec. 1998, at 181 (reporting survey findings that few Medicare beneficiaries understood the differences between HMO and fee-for-service plans they had selected); Judith H. Hibbard et al., Informing Consumer Decisions in Health Care: Implications From Decision-Making Research, 75 MlLBANK Q. 395 (1997) (reviewing the evidence about the difficulties consumers experience in making health care choices).

84 See Robert J. Blendon et al., Understanding the Managed Care Backlash, Health Aff., Jul.-Aug. 1998, at 80, 86-87; Eve A. Kerr, Managed Care and Capitation in California: How do Physicians at Financial Risk Control Their Own Utilization?, 123 Annals of Internal Med. 500, 500 (1995).

85 See Robert Berenson, Beyond Competition, Health Aff., Mar.Apr. 1997, 173-75.

86 See id. at 174 (discussing physicians' patient-centered views on care).

87 See Roberto Ceniceros, Providers, Health Plan Settle: California Pricing Dispute May Signal Problems for Employers, Bus. Ins., June 8, 1998, at 1, 1.

88 See Galvin, supra note 44, at 9.

89 See Peter T. Kilborn, California Agency Ponders Bypassing Health Groups, N.Y. Times, Mar. 22, 1998, at A20, A20. See also Galvin, supra note 44, at 9.

90 See Ceniceros, supra note 87, at 1.

91 See id.

92 See Smith et al., supra note 45, at 133.

93 See generally Galvin, supra note 44 (discussing the definition of value in the health care context).

94 The main intermediary functions health plans perform are claims processing, provider reimbursement, risk pooling, utilization management, actuarial services and marketing. See Alden Solovy, Backlash to the Future: Is an HMO an HMO an HMO?, Hosp. & Health Networks, Apr. 20, 1996, at 42. As providers continue to aggregate and enter capitated contracts, plans' role as “risk-poolers" may become somewhat redundant. Many PSOs will demand that utilization management of review functions accompany any assumption of risk so that they are able to maintain active control over their financial exposure. See David C. Hillman, A Primer on PHO Capitation Contracts, 29 Health & Hosp. L. 288 (1996), available in LEXIS, Genmed Library, HOSPLW File.

95 See Galvin, supra note 44, at 9.

96 See Alicia A. Barnett, Who Needs the Middleman?, Bus. & Health, Jan. 1, 1997, at 34, 34-36; Solovy, supra note 29, at 52-56; Unland, The Emergence of Providers as Health Insurers, supra note 20, at 1-5; Deener, supra note 81, at ID.

97 See Meyer, supra note 76, at 36 (quoting George Halvorson, chairman of the American Association of Health Plans, who stated, “You can challenge the price, but someone has to do what we do."); Unland, The Emergence of Providers as Health Insurers, supra note 20, at 58.

98 For a discussion of several businesses that have tried direct contracting and abandoned the experiment, see The Last Days of Direct Contracting?, Hosp. & Health Networks, Oct. 3, 1998, at 34, 34.

99 See John L. Akula, Insolvency Risk In Health Carriers: Innovation, Competition, And Public Protection, Health Aff., Jan.-Feb. 1997, at 9, 23 (discussing ethical advantages of direct contracting in the context of insolvency risk); Julie Johnsson, Direct Contracting: Hospitals Discover its Risks and Rewards, supra note 29, at 40.

100 Akula, supra note 99, at 23.

101 Id. 102 See Dennis V. Kennedy & Marian C. Jennings, Beyond HMOs: Trends in Employer Direct Contracting, Healthcare Fin. Mgmt., Aug. 1998, at 45, 45; James L. Reinertsen, What's Next After Managed Care? A Minnesota Experiment, Group Practice Journal, Jan.-Feb. 1993, at 26, 27-28; Robinow supra note 55, at 62-64.

103 See Hirshfeld, supra note 38, at 49.

104 See Kilborn, supra note 89, at A20.

105 See id.

106 See Peter Sinton & Sabin Russell, Kaiser Raising Rates Up to 11%, S.F. Chron., Mar. 31, 1998,atDl,Dl.

107 See generally Robinson, supra note 9; Robinson & Casalino, supra note 9.

108 See Galvin, supra note 44, at 6-7. The term disintermediation has multiple meanings. In banking and finance, it refers to the flow of money out of banks, savings and loan associations, and other financial intermediaries into direct investment in market instruments such as Treasury bills, money market funds and other financial institutions' deposit instruments. See The New Palgrave Dictionary of Money and Finance, Vol. 1 683-85 (Peter Newman et al. eds., 1992). The term also refers to the elimination of financial intermediaries, such as banks and brokers, from financial transactions. This is the usage invoked here. See Symposium, Financial Services: Security, Privacy, and Encryption, 3 B.U. J. Sci. & Tech. 4, para. 36 (1997) (comments of Thomas W. Cashel).

109 See John F. Rockart & James E. Short, The Networked Organization and the Management of Interdependence, in The Corporation of the 1990s at 189, 204-06 (Michael S. Morton ed., 1991).

110 See Dell Computer (visited Mar. 29, 1999) <http://www.dell.com>.

111 See Amazon.com (visited Mar. 29, 1999) <http://www.amazon.com>.

112 See Stephanie Stoughton & Leslie Walker, Manufacturers' Online Stores Upset Their Retailers, Wash. Post, Feb. 8, 1999, at Al, Al.

113 See generally U.S. Department of Justice & Federal Trade Commission, Statements of Antitrust Enforcement Policy in Health Care (1996).

114 See Hirshfeld, supra note 38, at 4-6, 46-47.

115 See U.S. Department of Justice & Federal Trade Commission, supra note 113, at 73.

116 Id. at 47.

117 For example, Illinois exempts capitated PSOs from licensure if the employer agrees to assume responsibility for provision of benefits to its employees in the event that the PSO becomes insolvent. The attorney general of North Carolina has issued an opinion essentially agreeing with Illinois's position. See Hirshfeld, supra note 38, at 47 & n.93. Idaho's Department of Insurance, which assesses PSO arrangements on a case-by-case basis, has stated that “it would probably not require an insurance license if a provider enters into an arrangement with a licensed insurer or self-funded employer and the responsibility to members remains with the insurer or self-funded employer." NAIC, supra note 15, at 1-18 to 1-24. See Hirshfeld, supra note 38, at 46-47. In addition, several other states have passed PSO-specific legislation that establishes special licensure concessions, including lower thresholds for deposit, reserve and solvency requirements than are imposed on other risk-bearing health insurers such as HMOs. See, e.g., Ga. Code Ann. § 33-3-6-7; Minn. Stat. § 62N.28 (West 1996).

118 See Balanced Budget Act of 1997, Pub. L. No. 105-33, § 4001 (1997). A detailed set of provisions regarding solvency and other PSO requirements were published in June 1998. See 42 C.F.R. §§422.350-.390(1998).

119 See Vickie Yates Brown & Barbara Reid Hartung, Managed Care at the Crossroads: Can Managed Care Organizations Survive Government Regulation, 7 Ann. Health L. 25, 50 (1998) (reporting that the American Medical Association “successfully lobbied for this definition, as it would permit physicians to organize PSOs without hospital ownership partners.")

120 See id.

121 See Mary Jane Fisher, Medicare+Choice Apps Trickle in Slowly, Nat'l Underwriter Life & Health-Financial Serv. Ed., Sept. 21, 1998, at 39, 39; Harris Meyer, Look Before You Launch, Hosp. & Health Networks, Jan. 20, 1998, at 22, 22.

122 See Blendon et al., supra note 84, at 81.

123 See Robert M. Goldberg, Why HMOs Now Love Regulation, Wall St. J., July 17, 1998, at A14, A14.

124 A series of rival bills were introduced in the 105th Congress, and have been reintroduced for debate in the 106th Congress, that would strengthen procedural protections afforded managed care patients in benefits decision-making processes. Some bills would also facilitate patients' ability to bring suit against their health plan for inappropriate delay or denial of benefits. See, e.g., H.R. 4250, 125th Cong. (1998) (reintroduced as H.R. 448); H.R. 3605, 105th Cong. (1998) (reintroduced as H.R. 358); H.R. 2960, 105th Cong. (1997); H.R. 1415, 105th Cong. (1997) (reintroduced as H.R. 216); S. 2416, 105th Cong. (1998) (reintroduced as S. 374); S. 2330, 105th Cong. (1998) (reintroduced as S. 300); S. 1890, 105th Cong. (1998) (reintroduced as S. 6). See also H.R. 719, 106th Cong. (1999).

125 See Studdert et al., Expanding Managed Care Liability: What Impact on Employment-Based Health Coverage? 16-17 (Apr. 1999) (unpublished manuscript on file with author).

126 See Tom L. Beauchamp & James F. Childress, Principles of Biomedical Ethics 189-325 (4th ed. 1994) (discussing the principles of “nonmaleficence" and “beneficence"); Council of Ethical & Judicial Affairs, American Med. Ass'n, Code of Medical Ethics xiv (1994).

127 See generally Troyen Brennan, Just Doctoring: Medical Ethics in the Liberal State (1991) (analyzing the relationship of medical ethics to the law that governs health care as well as changes in the economic and political structure of medical practice); Ezekiel J. Emanuel, the Ends of Human Life: Medical Ethics in A Liberal Polity (1991) (examining whether there is a proper approach to medical ethics questions, why such questions seem to lack resolution in American society and whether a resolution to medical ethics questions exists); E. Haavi Morreim. Balancing Act: The New Medical Ethics of Medicine's New Economics (1995) (discussing the physician's ethical obligations in light of medicine's new economics).

128 See Mark A. Hall, Making Medical Spending Decisions: the Law, Ethics & Economics of Rationing Mechanisms 171-92 (1997) (discussing the use of financial incentives to induce physicians to consider treatment costs); Marc A. Rodwin, Medicine, Money & Morals: Physicians' Conflicts of Interest 135-75 (1993). See generally Mary A. Bobinski, Autonomy and Privacy: Protecting Patients From Their Physicians, 55 U. Pitt. L. Rev. 291 (1994) (discussing risks— not specifically related informational privacy—that are posed to patient welfare by physicians' economic incentives, and analyzing the merits of disclosure mandates as an approach to deal with such risks).

129 See Morreim, supra note 127, at 60-63.

130 See Robert M. Gellman, Prescribing Privacy: The Uncertain Role of the Physician in the Protection of Patient Privacy, 62 N.C. L. Rev. 255, 280-93 (1984) (discussing various dilemmas faced by physicians in disclosing patient information to third parties).

131 Ironically, full risk contracts may provide a degree of clinical autonomy that liberates physicians from concerns about disclosure in every recorded treatment decision.

132 An analogous situation arises in the context of workers' compensation. Occupational medicine physicians serve both employers and the injured employees who are their patients. Hashimoto has argued, “the challenge to physicians lies in shaping managed care programs in ways that preserve their professional integrity." See Dean M. Hashimoto, The Future of Managed Care and Capitation in Workers' Compensation, 22 Am. J.L. & Med. 233, 258 (1996). To guard against this conflict, he recommends that physicians: (1) disclose to patients that medical information may be released; (2) take a stand on anonymizing the information; (3) remain obligated to communicating all relevant medical information to the patient, even if the medical finding does not fall strictly within the letter of the contract; and (4) fully inform the patient about the nature of his business relationship with the employer. See id. at 258-60.

133 See Disability Policy Panel, Nat'l Academy of Soc. Ins., The Environment of Disability Income Policy: Programs, People, History and Context 29-41 (Jerry L. Mashow & Virginia P. Reno eds., 1996).

134 See generally Debra T. Ballen, The Sleeper Issue in Health Care Reform: The Threat to Workers' Compensation, 79 Cornell L. Rev. 1291, 1295-302 (1994) (examining new forms of workers compensation medical care delivery in the context of the proposed Clinton health care reform); Lawrence C. Baker & Alan B. Kreuger, Twenty-Four-Hour Coverage and Workers' Compensation Insurance, Health Aff., Supp. 1993, at 271 (analyzing the potential administrative and efficiency gains from 24-hour coverage); Jay Himmelstein & Kathleen Rest, Working on Reform: How Workers' Compensation Medicare Care is Affected by Health Care Reform, 111 Pub. Health Rep. 12, 21-22 (1996) (describing the evolution of the 24-hour care models).

135 See Hashimoto, supra note 132, at 260.

136 Cardiomyopathy is a disease of the heart muscle. This condition covers several disease types: principally dilated, hypertophic (enlargement) or restrictive cardiomyopathy. Although cardiomyopathies resolve over time, many become chronic limitations on cardiopulmonary function. See Cecil Textbook of Medicine 332-43 (James B. Wyngaarden et al. eds., 19th ed. 1992).

137 See Galvin, supra note 44, at 3-5.

138 42 U.S.C. §§ 12101-12213 (1990).

139 See infra notes 189-95 and accompanying text. Note, however, that some decision making by employers about the content and limits of employee health benefits plans may be protected from American with Disabilities Act claims by the Employee Retirement Income Security Act (ERISA). See McGann v. H&H Music Co., 946 F.2d 401 (5th Cir. 1991), cert, denied, 113 S. Ct. 482 (1992) (holding that an employer did not unlawfully discriminate against employee for exercising rights under an ERISA-qualified plan).

140 See infra notes 189-95 and accompanying text.

141 See Gary S. Becker, Crime and Punishment: An Economic Approach, 76 J. of Pol. Econ. 169, 172-73 (1968).

142 See generally Donald F. Cox & Christopher Hogan, Biased Selection and Medicare HMOs: Analysis of the 1989-1994 Experience, 54 Med. Care Res. & Rev. 259 (1997) (examining an analysis of preenrollment and postdisenrollment experiences of Medicare-risk HMO enrollees); Daniel L. Dunn, Applications of Health Risk Adjustment: What Can be Learned from Experience to Date?, 35 INQUIRY 132 (1998) (summarizing four case studies describing real-world applications of health status risk adjustment to determine payments to health plans and providers); Harold S. Luft, Potential Methods to Reduce Risk Selection and its Effects, 32 INQUIRY 23 (1995) (analyzing several settings where risk differences occur, the individual problems for each setting and several approaches for their assessment); Joseph P. Newhouse, Risk Adjustment: Where Are We Now?, 35 INQUIRY 122 (1998) (analyzing several settings in which risk differences occur, the problems common to each setting and several solutions to these problems); James C. Robinson & Laura B. Gardner, Adverse Selection Among Multiple Competing Health Maintenance Organizations, 33 Med. Care 1161 (1995) (examining risk selection among nine competing health plans); Deborah L. Rogal & Anne K. Gauthier, Are Health-Based Payments a Feasible Tool for Addressing Risk Segmentation?, 35 INQUIRY 115 (1998) (assessing the success of risk-adjusted payments and proposing tools to address the broader problems in the health industry which affect it); Erik M. van Barneveld et al., Mandatory Pooling as a Supplement to Risk-Adjusted Capitation Payments in a Competitive Health Insurance Market, 47 Soc. SCI. & Med. 223 (1998) (comparing high-risk pooling with two other pooling options and assessing their likelihood of success); Wynand P. van de Ven et al., Risk-Adjusted Capitation: Recent Experiences in the Netherlands, Health Aff., Winter 1994, at 120 (detailing the proposed health reforms in the Netherlands and the effects of the 1993 implementation of risk-adjusted payments in public health insurance).

143 As Luft notes, “The only time risk assessment and risk adjustment are not necessary is when there is a unitary plan enrolling the entire eligible population." Luft, supra note 142, at 23.

144 Joseph P. Newhouse, Patients at Risk: Health Reform and Risk Management, Health Aff., Spring 1994, 132, 132. To combat this behavior, policy-makers have sought to develop accurate risk-adjusters that allow payments to approximate the marginal cost of treating the most expensive patients in a risk pool. In fact, risk-adjusted payments need not be calculated to equal marginal cost precisely; they need only be close enough to ensure transactional or “search" costs associated with risk-selection practices exceed any cost savings derived from them. See van de Ven et al., supra note 142, at 31. However, despite some impressive gains, the science of risk-adjustment remains fairly rudimentary and cannot approximate marginal cost closely enough to eliminate plans' (and providers') incentives both to “cream skim" and to “stint." See Newhouse, supra note 142, at 125.

145 See Committee on Employer-Based Health Benefits, Institute of Medicine, Employment and Health Benefits: A Connection At Risk 236-37 (Marilyn J. Field & Harold T. Shapiro eds.) (1993) [hereinafter IOM II] (containing a description of this phenomenon).

146 See Jonathon J. Gruber, The Incidence of Mandated Maternity Benefits, 84 Am. Econ. Rev. 622, 626 (1994); Lawrence H. Summers, Some Simple Economics of Mandated Benefits, 79 Am. Econ. Rev. 177, 181 (1989).

147 See Pauly, Mark V., Taxation, Health Insurance, and Market Failure in Medical Care, 24 J. Econ. Lit. 629, 634 (1986)Google Scholar (discussing the link between tax treatment and medical care expenses).

148 See id.

149 Marilyn Field and Harold Shapiro make a similar point. See IOM II, supra note 145, at 246 ("As long as employers' payments for employee health benefits vary depending on the health status of their workers, employers will still have an incentive to avoid high-risk or high-cost workers or dependents above and beyond that related to their concerns about workers' compensation, absenteeism, and similar costs.").

150 For example, firms will already have easy access to some reasonable markers for employees with high medical costs, such as data on absenteeism or special accommodations in the workplace. See Wise, supra note 28. In addition, data from longstanding employee assistance programs may be at their disposal. See id. See also Schwartz, Paul M., The Protection of Privacy in Health Care Reform, 48 Vand. L. Rev. 295, 304 (1995)Google Scholar.

151 See Marc L. Berk & Alan C. Monheit, Health Aff., Winter 1992, at 145, 146 (reporting that in 1987 the top 1% of the population in accounted for 30% of all medical expenditures, while the “healthiest" half of the total population accounted for only 3%). For a discussion of selection issues that may arise given this skewed distribution, see Harold S. Luft, Modifying Managed Competition to Address Cost and Quality, Health Aff., Spring 1996, at 23, 26-28.

152 See Barefoot, Bartley L., Enacting a Health Information Confidentiality Law: Can Congress Beat the Deadline?, 77 N.C. L. Rev. 283, 348 (1998)Google Scholar (citing congressional testimony from several major employers attesting to voluntary implementation of internal guidelines designed to protect the confidentiality of employees' health data).

153 See IOM II, supra note 145, at 246.

154 See Bayer, Ronald & Toomey, Kathleen E., HIV Prevention and the Two Faces of Partner Notification, 82 Am. J. Pub. Health 1158, 1158 (1992)CrossRefGoogle Scholar.

155 See Bayer & Toomey, id. at 1160-61; City of Newark v. J.S., 652 A.2d 265, 265 (N.J. Super. Ct. Law Div. 1993); Tarasoff v. Regents of the Univ. of Cal., 551 P.2d 334, 347 (Cal. 1976).

156 See, e.g., Alan F. Westin, Privacy And Freedom 8-51 (1967) (comprehensively reviewing anthropological and sociopolitical bases of privacy interests); Joel Feinberg, Autonomy, Sovereignty, and Privacy: Moral Ideals in the Constitution?, 58 Notre Dame L. Rev. 445, 473 (1983) (discussing moral justifications for modern notions of privacy and autonomy).

157 Lawrence O. Gostin et al., Privacy and Security of Health Information in the Emerging Health Care System, 5 Health Matrix 1, 23 (1995) [hereinafter Gostin II].

158 Id. at 23. For a discussion of various ethical justifications for privacy and confidentiality protections in the context of health care information, see id. at 21-23.

159 See, e.g., Allan M. Brandt, No Magic Bullet: Social History of Venereal Disease in the United States Since 1880, 24-26 (1985) (tracing surveillance and reporting debate about sexually transmitted diseases back to the turn of the century). See also Lawrence O. Gostin & James G. Hodge, The “Names" Debate: The Case for National HIV Reporting in the United States, 61 ALB. L. Rev. 679, 683-92 (1998) (discussing public health reporting laws in the colonies in the seventeenth century).

160 See Gostin I, supra note 2, at 472-84.

161 See Barefoot, supra note 152, at 341-44.

162 See id. at 339.

163 See Gostin II, supra note 157, at 23; Council on Competitiveness, Highway to Health: Transforming U.S. Health Care in the Information Age (last updated Mar. 25, 1996) <http://nii.nist.gov/pubs/coc_hghwy_to_hlth/titIe_page.html>.

164 For ease of exposition, the Article classifies users of health care data according to their status as primary, secondary and tertiary users. These classifications roughly correspond to Alan Westin's taxonomy of the “three zones" in which the information is used. Paul Schwartz has summarized these zones as follows, “… zone one is direct patient care (doctors, clinics, nursing homes); zone two consists of supporting and administrative activities (service payers, third[-]party administrators, quality of care reviewers); and zone three includes broader applications of health data, termed “secondary uses" (credential and evaluation decisions, public health reporting, social welfare programs, direct marketing)." Schwartz, supra note 150, at 301.

165 See National Committee on Vital & Health Statistics, supra note 13.

166 In a 1993 Equifax/Harris survey, 79% of respondents were very or somewhat worried about a threat to personal privacy. Eighty percent of respondents believed that consumers had lost control over how personal information about them is circulated and used. See Committee on Regional Health Data Networks, supra note 13.

167 See Gostin I, supra note 2, at 494-95; Mark A. Rothstein et al., Protecting Genetic Privacy by Permitting Employer Access Only to Job-Related Employee Medical Information: Analysis of a Unique Minnesota Law, 24 Am . J.L. & Med. 399, 401-09 (1998) (reviewing federal and state protections against genetic discrimination); Schwartz, supra note 150, at 296 (discussing the need for uniformity in fair information practices for the use of health care data in the United States); IOM I, supra note 2, at 148-49.

168 gee supra notes 166-67 and accompanying text.

169 See Committee on Regional Health Data Networks, supra note 13, at 151-152; Department of Health and Human Services, Confidentiality of Individually-Identifiable Health Information: Recommendations to the Secretary of Health and Human Services, pursuant to section 264 of the Health Insurance Portability and Accountability Act of 1996 (visited Mar. 23, 1999) <http://aspe.os.dhhs.gov/admnsimp/pvcrecO.htm> [hereinafter HHS].

170 HHS, supra note 169.

171 See Barefoot, supra note 152, at 293-305; Gostin I, supra note 2, at 494-513; Rothstein et al., supra note 167, at 405-07; Schwartz, supra note 150, at 310-23. For a history of attempts to introduce privacy reforms, see Gostin II, supra note 157, at 8-12.

172 429 U.S. 589(1977).

173 See National Research Council, supra note 2, at 43. Lower courts have attempted to build upon the framework established in Whalen, but have had some difficulty agreeing on its scope and meaning. See, e.g., J.P. v. DeSanti, 653 F.2d 1080, 1087-90 (6th Cir. 1981) (holding no general constitutional protection for confidentiality of personal information); American Fed'n of Gov't R.R. Retirement Bd. v. United States R.R. Retirement Bd., 742 F. Supp. 450, 453-55 (N.D. 111. 1990) (applying a right to privacy to protect government job candidates from certain mandatory disclosure requirements).

174 See Gostin II, supra note 157, at 14.

175 5U.S.C. § 552a (1994).

176 See Gostin I, supra note 2, at 499-506 (surveying federal statutes and regulations providing limited privacy protection in highly specific circumstances); Schwartz, supra note 150, at 314-20.

177 See 42 U.S.C. § 290dd (1994).

178 See Gostin I, supra note 2, at 499-506.

179 See id. at 507-08.

180 Gostin II, supra note 157, at 15.

181 See id. at 14.

182 See Gostin I, supra note 2, at 510.

183 See id. at 508-09.

184 See id. at 510.

185 See id. at 510-11.

186 See, e.g., Humphers v. First Interstate Bank of Oregon, 696 P.2d 527, 534 (Or. 1985).

187 See Schwartz, supra note 150, at 321-22.

188 See id.

189 See 42 U.S.C. § 12112 (1990). The ADA was enacted in 1990 to protect individuals with disabilities from discrimination. See § 12101 (findings and purposes). The underlying objective of the ADA was to assure the equality of opportunity, full participation, equal living and self-sufficiency necessary to allow people with disabilities to compete for society's goods and services on an equal basis. See Lawrence O. Gostin, The Americans with Disabilities Act and The Corpus of Anti-Discrimination Law: A Force for Change in the Future of Public Health Regulation, 3 Health Matrix 89, 104(1993).

190 See 42 U.S.C. § 12112(d)(2).

191 See id. Restrictions include the requirement that medical information be collected on separate forms, maintained in separate files and be treated as confidential, subject to certain limited exceptions. For a comprehensive description of these provisions, see Rothstein et al., supra note 167, at 405-07.

192 See 42 U.S.C. § 12112(d)(3).

193 See IOM II, supra note 145, at 246.

194 Id. (emphasis in original).

195 452 U.S.C. § 12112(a).

196 See id. § 12111(5)(a). For additional exclusions based on the definition of a covered “employer" under the Act, see § 1211 l(5)(b).

197 See supra notes 47-82 and accompanying text.

198 See supra note 141 and accompanying text.

199 42 U.S.C. § 12102(2).

200 See Zamora-Quezada v. Health Texas Med. Group of San Antonio, 34 F. Supp. 2d 433, 433 (W.D. Tex. 1998) (involving HMO enrollees' suit against HMO medical provider for injunctive relief under the ADA, alleging delay or denial of services to disabled HMO enrollees).

201 In addition, an employer may argue that a discordance arises between large expenditures and the presence of a disability in circumstances where it is claimed that unacceptable expense rather than the disability itself motivated the behavior at issue. However, courts are likely to regard this as a semantic distinction which, if made, would defeat the spirit and purpose of the Act. For a refutation of a similar argument in the context of discrimination law, see School Bd. of Nassau County v. Arline, 480 U.S. 273, 282 (1987).

202 42 U.S.C. § 12201(c).

203 Specifically, the provision states that nothing in the ADA shall prohibit or restrict: (1) entities administering benefit plans, such as insurers and hospitals, from dealing with risks in a manner that does not breach state law; (2) insurers from establishing or administering the terms of “a bona fide benefit plan" that are based on underwriting, classifying or administering risks in a manner that does breach state law; or (3) insurers not covered by state insurance laws (a category self-insured employers fit into given ERISA-preemption issues) from establishing and administering the terms of a bona fide benefit plan. Id.

204 Subterfuge is not defined under the Act; however, guidelines issued in 1993 stated that a “disability-based distinction"—defined as a distinction that singles out a particular disability such as acquired immune deficiency syndrome, deafness or schizophrenia—shifts the burden of proof to the employer to prove no subterfuge is involved. The guidelines further define subterfuge as a “disability based disparate treatment that is not justified by the risks or costs associated with the disability." Equal Employment Opportunity Commission, Interim Enforcement Guidance to the Application of the ADA to Disability Based Discrimination in Employer Provider Health Insurance 7, 11 (June 8, 1993). The clarifications provided in these guidelines do not constitute a resounding refutation of the possibility that certain forms of employee risk selection undertaken by self-insuring firms in direct contracts could be construed as exceptions to the ADA's discrimination provisions under section 501(c).

205 See Committee on Regional Health Data Networks, supra note 13, at 158-60.

206 See, e.g., Mike Martindale, Secret Files Spark Postal Service Suit, Detroit News, Oct. 6, 1998, at D6, D6; Alissa J. Rubin, Records No Longer for Doctor's Eyes Only, L.A. Times, Sept. 1, 1998, at Al , Al ; Ellen E. Schultz, Open Secrets: Medical Data Gathered by Firms Can Prove Less Than Confidential, Wall St. J., May 18, 1994, at Al , Al .

207 See Committee on Regional Health Data Networks, supra note 13, at 1.

208 See Janlori Goldman, Protecting Privacy to Improve Health Care, Health Aff., Nov.-Dec. 1998, at 47, 52; Rubin, supra note 206, at Al.

209 See Goldman, supra note 208, at 52 (reporting that more than 250 bills with medical privacy provisions were introduced into state legislatures in the last year alone). See also Key Lawmakers Announce Plans to Push for Privacy in Medical Records, 8 Health L. Rep. (BNA) 23, 23 (1999) (stating that the Connecticut Senate president plans to introduce legislation shortly that will establish a right to privacy related to medical records); D. Ward Primley, Maine Experience Shows Potential Snag As Public Grapples with Patient Privacy, 8 Health L. Rep. (BNA) 173, 173 (1999) (stating that Maine legislators are responding to the medical information privacy concerns of Maine residents).

210 See Colby, Jeremy A., An Analysis of Genetic Discrimination Legislation Proposed by the 105th Congress, 24 Am. J.L. & Med. 443, 464-66 (1998)Google Scholar; Rothstein et al., supra note 167, at 401-03.

211 See HHS, supra note 169.

212 42 U.S.C. §§ 1320d to d-8 (1998).

213 The Act charged the Secretary of the Department of Health and Human Services with preparing for Congress “detailed recommendations with respect to the privacy of individually-identifiable health information." These recommendations were submitted in September, 1997. See HHS, supra note 169. The Act also contains a sunset provision on congressional action: should the House of Representatives fail to passed legislation by August 21, 1999, the Secretary is directed to promulgate regulations governing privacy standards for electronic health data. See 42 U.S.C. § 1320d-2. Thus, it was with some degree of certainty that President Clinton could announce in his 1999 State of the Union Address that, “one way or another, we will protect the privacy of medical records this year." Health Care Excerpts of President Clinton's 1999 State of the Union Address (Jan. 19, 1999) <http://www.chttp://www.cchc-mn.org/stunion.htmlchc-mn.org/stunion.html>.

214 In addition, the President's Advisory Commission on Consumer Protection and Quality in the Health Care Industry recognized the increasingly proactive role played by employers, particularly self-insured firms, in the management of information in emerging health care arrangements. See President's Advisory Commission on Consumer Protection and Quality in the Health Care Industry, Consumer Bill of Rights and Responsibilities, Chapter Six: Confidentiality of Health Information (visited Apr. 24, 1999) <http://www.hhttp://www.hcqualitycommission.gov/final/append_a.html%23chpt6cqualitycommission.gOv/final/append_a.html#chpt6>. However, the Advisory Commission chose to sidestep the tough questions in this area. See Confidentiality of Health Information, Prepared for Subcommittee on Consumer Rights, Protections and Responsibilities of the Advisory Commission on Consumer Protection and Quality in the Health Care Industry (Draft Aug. 13, 1997) (visited Apr. 24, 1999) <http://www.hhttp://www.hcqualitycommission.gov/meetings/augustl3/papconfi.htmcqualitycommission.gov/meetings/augustl3/papconfi.htm>.

215 The following bills were among those introduced into the 105th Congress: “Medical Privacy in the Age of New Technologies Act of 1997" (H.R. 1815), sponsored by Rep. Jim McDermott (D-WA); “Fair Health Information Practices Act of 1997" (H.R. 52), sponsored by Rep. Gary Condit (D-CA); “Consumer Health and Research Technology Protection Act" (H.R. 3900), sponsored by Rep. Christopher Shays (R-CT); “The Medical Information Privacy and Security Act" (S. 1368), cosponsored by Sen. Patrick J. Leahy (D-VT) and Sen. Edward M. Kennedy (D-MA); and “Health Care Personal Information Nondisclosure Act of 1998" (S. 1921), cosponsored by Sen. Jim M. Jeffords (R-VT) and Sen. Christopher J. Dodd (D-CT).

216 The key point of disagreement relates to preemption, namely whether the federal legislation should merely establish a floor for privacy protections and allow states to enact more stringent privacy regulation, or establish a ceiling, thereby occupying the field by preempting both more and less stringent state laws in the same domain. See Goldman, supra note 208, at 55-56. Generally, Democrats' bills tend toward a floor while Republicans favor a ceiling (with some exceptions). See id.; Experts Say Medical Privacy Legislation “Needed" But Disagree on Preemption Issue, 7 Health L. Rep. (BNA) 866, 866-67 (1998); Legislation That Includes Preemption Would Weaken Some Existing State Laws, 7 Health L. Rep. (BNA) 1857, 1857-58 (1998).

217 All the bills are organized similarly, covering three main areas: (1) patients' rights to access and correct personal health care information; (2) restrictions on use and disclosure; and (3) civil and criminal penalties.

218 See supra note 215 and accompanying text.

219 S. 1921, 105th Cong. § 202 (1997).

220 See id.

221 H.R. 1815, 105th Cong. § 201 (1997).

222 See Goldman, supra note 208, at 53-54.

223 See id. at 54. Tier one users correlate roughly with our previous references to secondary users, although strictly speaking they are that subset of secondary users directly involved in health care delivery. See supra note 164 and accompanying text.

224 Variation exists among the bills on the specifics of tier one. For example, S. 1368, 105th Cong. (1997) and H.R. 1815, 105th Cong. (1997) include only disclosures necessary for treatment and payment in tier one; S. 1921, 105th Cong. (1998) adds “health care operations" while H.R. 52, 105th Cong. (1997) adds use by a health care oversight agency. The Shays bill actually waives the need for authorization for disclosures related to treatment, payment, and certain health care operations. See Subcomm. on Gov't Mgmt., Info., and Tech. Before the House Comm. on Gov't Reform and Oversight, 106th Cong. (1998) (statement of Janlori Goldman).

225 See Goldman, supra note 208, at 54.

226 H.R. 1815 § 201(e)(2).

227 S. 1368, § 202(c)(3).

228 HHS, supra note 169.

229 Id.

230 Id. (emphasis added).

231 The analogy here is to the conceptual division created in legal practice to guard against intra-firm conflicts of interest. Black's Law Dictionary defines a Chinese Wall as “a fictional device used as a screening procedure which permits an attorney involved in an earlier adverse role to be screened from other attorneys in the firm so as to prevent disqualification of the entire law firm simply because one member of firm previously represented a client who is now an adversary of the client currently represented by the firm." Black's Law Dictionary 240 (6th ed., 1990).

232 HHS, supra note 169.

233 See Americans with Disabilities Act of 1990, 42 U.S.C. § 12112; 41 C.F.R. § 60-741.23 (regulation made pursuant to Rehabilitation Act of 1973, 29 U.S.C. § 793). Section 102 of the ADA is modeled on the regulation under the Rehabilitation Act and largely subsumes it. Hence this discussion of antidiscrimination law centers on the ADA provisions.

234 HHS, supra note 169.

235 See supra notes 47-49 and accompanying text.

236 Use of health information trustee in this discussion should not be confused with the different use and definition of that term in H.R. 1815. See supra note 224.

237 See Wise, supra note 28.

238 Personal communication with David Knutson, Director of Health System Studies, Institute for Research and Education, HealthSystem Minnesota, in Minneapolis, Minn. (Feb. 9, 1999) (interview discussing the implementation of Choice Plus, 1994-1999); Robinow, supra note 68.

239 See Robinow, supra note 55, at 64; Knutson supra note 50, at 171.

240 See Knutson, supra note 50, at 174.

241 See Blendon et al., supra note 84, at 84-85.

242 See supra note 215.