The long and winding road for the patient privacy portion of the Health Insurance Portability and Accountability Act has reached a major intersection. Next stop, the implementation expressway.

Today, the much-debated federal law's privacy regulations that now require health care providers to pass over to patients greater control of their own medical information go into effect. The new regulations are meant to ensure, among other aims, that patients have full access to their medical records, that medical information is not used for nonhealth purposes without patients' permission and that health care providers receive an accounting of disclosures of their health information.

Joanne Pollak addresses a group of researchers in East Baltimore.

The new rules not only will change the way hospitals do business but will also significantly impact how Johns Hopkins and other research organizations administer human research protocols, now that special authorizations will be required from patients and research subjects, according to Joanne Pollak, vice president and general counsel for Johns Hopkins Medicine and the university and health system's administrative vice president for HIPAA compliance.

"This law brings with it a whole slew of complicated forms for each specific use of health information," Pollak said. "Considering that we have more than 2,000 ongoing research studies, just the additional record keeping will be a major issue. It will also be an additional burden on institutional review boards, who now have a whole new layer of concerns they must contend with."

Is Johns Hopkins ready?

In preparation, nearly 18,000 employees have taken a basic HIPAA training course, either a Web-based or in-person version. In total, there are nine different training programs geared to specific personnel, who will be required to take the appropriate ones. Pollak said this is only the beginning.

"It's a complicated law," she said. "There are many new forms and many new policies, and our work force needs to learn about them all."

Beginning today, patients will receive a detailed 13-page document informing them of their new privacy rights. Johns Hopkins must ask patients to acknowledge receipt of the notice, and if they won't, keep a record of why.

HIPAA, which Congress passed in 1996, was originally focused on ensuring that employees could carry health care coverage from employer to employer. However, during the next four years, the law's privacy component was carried out by the Department of Health and Human Services, which grew a one-paragraph law into hundreds of pages of regulations.

Pollak said that the state has a fairly strong set of privacy protections and that HIPAA does not place significant additional restrictions on use or disclosure. However, two of HIPAA's guiding principles are that the health care work force use the "minimum necessary" patient information to get the job done and that the information be allotted on a "need-to-know" basis. These requirements will be complicated to apply, she said. For example, when a person needs to do billing, is the whole record required?

While the massive administrative load of HIPAA will "likely work out in time," Pollak said, the university and health system have long maintained that the extra burden is extremely costly and is neither necessary nor does it significantly advance the privacy interests of patients in Maryland.

"This is something we have to do, but we have always supported the privacy interests of our patients and constituents. We have had few complaints, and if we did, there were usually special circumstances. Because we do more research than anyone, the extra administrative burdens on research are great," she said. "Yes, we will get used to the extra forms, and I think we can function. But we don't see the burden as being needed."

One particular concern is the impact the new law could have on fund raising. Pollak gave as an example the Oncology Department's Development Office sending letters to former patients to ask if they would like to give to the program. Under HIPAA, any use or disclosure of protected health information for targeted fund raising requires special authorization from the patient.

"We feel that to hand the patient a document about fund raising when he or she is here for treatment is hard to do," she said. "This may have a chilling effect on fund raising efforts, which rely heavily on grateful patients."

For the past two years, Pollak has lobbied on behalf of Johns Hopkins to amend HIPAA and make the rules less stringent. She said there have been some successes, but now her efforts are focused on helping comply with the new law of the land.