With the bees back in the hive and the kids back in school, I faced the task of trying to understand the Health Insurance Portability and Accountability Act, known as HIPAA.We had already weathered CLIA and EMTALA, government regulations that made providing care more difficult for us and more expensive for our patients.

The Clinical Laboratory Improvement Amendments (CLIA), passed in 1988, shut down our office lab, where we had been able to perform simple throat and urine cultures. Instead, we now were required to send cultures to a certified lab; the results took more time and the tests cost patients a great deal more money.

The Emergency Medical Treatment and Active Labor Act (EMTALA), known as the "anti-dumping law," was passed in 1986 to ensure access to emergency services regardless of patients' ability to pay. Grace Cottage has always provided emergency care to all comers, regardless of their financial status; EMTALA changed how. Before EMTALA, a patient who showed up at the ER during regular office hours with a simple laceration or common illness was sent to the office of whichever doctor was on call. The patient was seen promptly, along with all the other, regularly scheduled patients. But EMTALA requires that a patient be seen in the ER. For Tim, whose office is a mile from the hospital, this means leaving a waiting room full of patients with appointments (most made weeks before) to take care of someone—usually an out-of-towner—who'd walked into the ER. That patient, of course, then incurred hospital charges as well as physician charges, driving up the cost of the care.

Our experience with CLIA and EMTALA made us fear that HIPAA would be worse. HIPAA was initially passed in 1996, but its Privacy Rule wasn't scheduled to go into effect until April 2003. The first conference I attended confirmed my fears that compliance with the new law would mean both more paperwork for our staff

and a significant, added expense. It was not clear to me if or how the law would protect our patients' privacy more or even any differently from how we already guarded their personal health information. Again, the rules were written with huge organizations in mind, not a small, rural practice run by a doctor and his wife.

An 11th-hour reprieve for small establishments gave us an extra year before we had to have all our forms in place. But I didn't see how another year would make any significant difference to the bottom line. Complying with HIPAA would have required us to retool our information technology yet again. It would hold us all, individually and collectively, accountable for noncompliance, including fines and criminal charges. More than once I wondered who was writing these laws!

Officials in Washington were writing these laws and, briefly, in the winter and spring of 2003, I was talking with people at both the state

and federal level about turning our little RHC into a Federally Qualified Health Center (FQHC). This would have made it the hub of a network stretching across at