The lawsuit on behalf of privacy groups and other organizations from around the country challenges regulations drawn up by the Health and Human Services Department to implement the Health Insurance Portability and Accountability Act.

Named as lead defendant in the action is Department of Health and Human Services Secretary Tommy G Thompson. The complaint charges that privacy rules amended by HHS last August eliminate privacy protections for personal health information.

Challenged are sections of the rules which allow certain groups, including insurance companies, to use and disclose personal health information--such as treatment, payment and health care operations--without consent and regardless of the patient's wishes.

"We are seeking to declare invalid the portions of amendments in HIPAA that eliminated the right of consent" by patients before records could be disclosed, Mr. Pyles said.

"It's filed to restore the right of consent for consumers, which the HHS' own rulemaking record says is essential for quality health care. And we believe strongly that it is true," Mr. Pyles told National Underwriter.

The HIPAA, which is designed to facilitate the storage and transmission of health information by computer while protecting patients' rights, prohibits hospitals, pharmacies, insurance companies and other health care groups from using or disclosing health information for non-routine purposes without patient permission.

Still, routine disclosures--which include treatment, payment and health care operations--are permitted without the patient's knowledge or consent and without any accounting, Mr. Pyles said.

Violators could face civil and criminal penalties up to $250,000 in fines and 10 years in prison. However, interim regulations partially implementing the sanction provisions were only issued April 17 and do not go into effect for at least 30 days, Mr. Pyles said. Further, the privacy rule directs the Health and Human Services Secretary to seek to resolve violations informally first before invoking sanctions.

According to the lawsuit's complaint, despite sanction provisions, the new law would end up giving insurance and drug companies more access to individual medical records without patients' permission.

Among the insurance related sections of the rules are provisions designed to exempt the transmission of data needed to process workers' compensation claims.

"What we are finding is that many patients really object to that, particularly among cancer survivors and those who don't want pictures of their breast surgery traveling around the Internet. They would rather not have that happen," Mr. Pyles said.

"This was not permitted before without their consent. But now it's permitted even when patients object."

He explained that the lawsuit was filed in Philadelphia as a symbolic gesture, "because that's where the right of liberty was originally adopted as a constitutional right and we thought it was appropriate that it either be preserved or that it die there."

The plaintiffs include the Washington, D.C.-based Citizens for Health; American Association for Health Freedom in Great Falls, Va.; American Association of Practicing Psychiatrists in Kensington, Md.; St. Louis-based American Mental Health Alliance U.S.A.; American Psychoanalytic Association, based in New York; National Coalition of Mental Health Professionals and Consumers from Commack, N.Y.; and New Hampshire Citizens for Health Freedom in Keene, N.H.