Over the objections of privacy advocates, the Bush administration on August 14 issued new standards on the handling of patient medical records, replacing protections adopted in the last month of the Clinton administration that were strongly opposed by HMOs, insurance companies, and pharmaceuticals. Unlike the Clinton rules, which the Bush administration immediately suspended upon taking office, the revised standards do not require health care providers to obtain patients' written permission before sharing medical records with hospitals, pharmacies, and insurance companies. Instead, they merely require that entities handling medical records inform patients of privacy practices. By removing the written-consent requirement, the Bush administration has shifted control of sensitive medical information from the patient to the provider and opened the door for the use of medical records for marketing purposes. Although pharmacists may not sell patients' medical information directly to drug companies, the rule will permit drug companies to pay pharmacists to recommend that patients switch from one drug to another without divulging details of the financial arrangement. The new rules use such a narrow definition that this type of activity would not be classified as "marketing." Under the Clinton rules, marketing based on medical records was permitted and broadly defined but protections were in place to enable patients to opt out of promotional mailings. The old rules also mandated full disclosure of financial support behind marketing activities. Patients will now be left in the dark in determining the origins of health-related promotions and have no way to halt the flow of record-based marketing. The Bush administration and industry representatives claim the revised rules will ensure privacy and result in better medical care, but privacy advocates view the rules as a setback. Janlori Goldman, Director of the Health Privacy Project at Georgetown University, said the rules "undermine patient control over private medical information." The rules, which establish the first comprehensive federal policy on medical record privacy, will apply only to electronic medical records and will require compliance by April 2003.