Bush Rolls Back Rules on Privacy of Medical Data.

The administration decided to abandon the core of the Clinton rules, a requirement that doctors, hospitals and other health care providers obtain written consent from patients before using or disclosing personal medical information for treatment or paying claims. Instead, providers will have to notify patients of their remaining rights and have to make "a good-faith effort to obtain a written acknowledgment of receipt of the notice."

...

The rules appear to set strict standards on using personal data from patients for marketing. They prohibit drugstores from selling personal medical information to a drug company or other business that wants to sell products or services.

In the last few years, some drug companies have paid pharmacies for customer health information and used it to try to sell products to individuals with conditions like osteoporosis, diabetes or depression.

Mary R. Grealy, president of the Health Care Leadership Council, which represents large health care corporations, said the new rules were "stronger and tougher" than the Clinton rules on marketing.

Representative Edward J. Markey, Democrat of Massachusetts, said the Bush administration had made some improvement in the marketing rules, but left some loopholes.

"The final regulations appear to shut down some of the existing avenues of commercial exploitation of personal medical data by third parties without the knowledge or consent of the patient," said Mr. Markey, who is co-chairman of the Congressional Privacy Caucus. "But the regulations still allow a drug company to pay a pharmacy to act as its agent and allow the pharmacy to do the marketing without disclosing the financial arrangement."

At first blush, the new rules seems better than the original rules proposed by the Clinton administration.