NRPM: Standards for Privacy of Individually Identifiable Health Information. F. Benefits.


As we have discussed in the preamble, there are important societal benefits associated with improving health information privacy. Confidentiality is a key component of trust between patients and providers, and some studies indicate that a lack of privacy may deter patients from obtaining preventive care and treatment 16. For these reasons, traditional approaches to estimating the value of a commodity cannot fully capture the value of personal privacy. It may be difficult for individuals to assign value to privacy protection because most individuals view personal privacy as a right. Because we promote the view that privacy protection is an important personal right, the benefits of the proposed regulation are impossible to estimate based on the market value of health information alone. However, it is possible to evaluate some of the benefits that may accrue to individuals as a result of proposed regulation, and these benefits, alone, suggest that the regulation is warranted. Added to these benefits is the intangible value of privacy, the personal security that we may feel when our records are confidential, which is very real and very significant but for which there is no economic value or proxy.

There are a number of ways to discuss the expected benefits of this proposed regulation. The first option is to discuss the benefits qualitatively. We believe that this is necessary to give the reader a basic understanding of how this proposed regulation will benefit society. The second option that we have used is to quantify the benefits of the proposed rule as they would apply to a few illness categories that may be particularly responsive to privacy concerns. This quantitative discussion is meant to be illustrative of the benefits rather than a comprehensive accounting of all of the benefits of the proposed rule. The combination of the two approaches clearly illustrates that the benefits of the regulation are significant in relation to the economic costs.

Before beginning our discussion of the benefits, it is important to create a framework for how the costs and benefits may be viewed in terms of individuals rather than societal aggregates. We have estimated the value an insured individual would need to place on increased privacy to make the proposed Privacy regulation a net benefit to those who receive health insurance. Our estimates are derived from data produced by the 1998 Current Population Survey from the Census Bureau, and report that 220 million persons are covered by either private or public health insurance. Joining the Census Bureau data with cost assumptions calculated in Section E, we have estimated the cost of the proposed regulation is $3.41 per insured individual. If we assume that individuals who use the health care system will be willing to pay more than $3.41 per year (or approximately $0.28 per month) to improve health information privacy, the benefits of the proposed regulation will outweigh the cost.

This is a conservative estimate of the number of people who will benefit from the regulation because it assumes that only those individuals who have health insurance will use medical services or benefit from the provisions of the proposed regulation. Currently, there are 44 million Americans who do not have any form of health care insurance. In addition, the estimates do not include those who pay for medical care directly, without any insurance or government support. By lowering the number of users in the system, we have inflated our estimate of the per-person cost of the regulation, therefore, we assume that our estimate represents the highest cost to an individual.

An alternative approach to determining how people would have to value increased privacy for this regulation to be beneficial is to look at the costs divided by the number of encounters with health care professionals annually. Data from the Medical Expenditure Panel Survey (MEPS) produced by the Agency for Health Care Policy Research (AHCPR) report approximately 1.62 billion health care visits, or encounters annually (e.g., office visits, hospital and nursing home stays, etc.). As with our calculation of average annual cost per insured patient, we have divided the total cost of complying with the regulation ($751 million per year) by the total annual number of health care encounters. The cost of instituting requirements of the proposed regulation is $0.46 per health care encounter. If we assume that individuals would be willing to pay more than $0.46 per health care encounter to improve health information privacy, the benefits of the proposed regulation will outweigh the cost.