This report focuses on confidentiality. NMHA selected this topic as an area for study because we believe our nation is facing a crisis in health privacy. The extensive treatment "authorization" processes required under managed care, combined with the increasing computerization of medical information, have led us to a society in which managed care administrators, employers, researchers, and even the police now have easy access to personal health information. In fact, more than one-third of Fortune 500 companies report checking medical records before hiring or promoting workers.

In addition, federal and state laws and regulations regarding privacy are minimal and rarely address activities specific to managed care organizations (MCOs). In fact, the only current federal legislative effort at the time of the printing of this document (H.R.10, SEC 351. Confidentiality of Health and Medical Information), provides no limits regarding the content of health information that can be shared. Instead, it provides an extremely long laundry list of largely administrative situations where an unspecified degree of information release is allowable even beyond clinical treatment authorization processes (e.g. settlement, billing, processing premiums, risk control, dispute resolution, transferring and reconciling of amounts charged, transfer of receivables/accounts, audits, etc.). In essence, the language allows virtually any person connected with an MCO to have access to nearly unlimited personal information for non-clinical purposes, without specified restrictions. It contains no meaningful protections for consumers, weakens many safeguards currently in practice, and, in fact, reads more like an MCO protection bill than a consumer protection bill.

NMHA strongly encourages legislators to take a more aggressive approach to protecting Americans' right to health privacy. The consequences of the current lack of confidentiality safeguards for consumers are devastating. It is estimated that at least one of every six people tries to protect his or her privacy by:

1. Misinforming or providing incomplete information to his/her clinician(s);

2. Paying out-of-pocket for treatment to avoid the establishment and maintenance of records by health plans; or worst of all;

3. Forgoing treatment altogether.

For people who utilize mental health services, the implications are even more disturbing. The impact of the stigma of mental illness, combined with the personal nature of information shared during psychotherapy, increases consumers' need for privacy exponentially. In response to this need, NMHA has conducted a thorough analysis of current confidentiality protocols under private sector managed care systems. We hope the information in this report will be used to:

• Help MCOs improve their operations;

• Help providers and their staff safeguard their clients' privacy;

• Alert consumers and their families to current policies and concerns;

• Help employers, benefits consultants, and accrediting bodies more effectively monitor managed care protocols; and

• Help legislators craft and draw support for meaningful reform in health privacy.

We hope that all readers of this report will use this information to ensure that many of the best practices identified become common practices. If we can provide support in these efforts, please contact NMHA's Advocacy Resource Center for additional assistance (1-800-969-NMHA (6642), Option 6).

Thank you for your ongoing advocacy and commitment to improving the quality of private sector managed mental health services.

"Top 10" Key Findings and Recommendations

Methodology

NMHA Standards for Responsible Management of Consumer Information (Position Statement P-34)

Maintenance of Consumer Information

Medical Records and Session Notes

Managed Care Staff Policies

Protocols For Clinicians and Their Staff

Special Populations and Circumstances