An elegant velvet rope—the kind used for VIP lines outside trendy nightclubs—now marks the proper place to stand while picking up prescriptions at one Washington drugstore. It's a little touch of glamour meant to assure the privacy of the customer at the pharmacy counter.

"Before the new privacy rule, all they had was a scuffed piece of tape on the floor, and no one paid any attention to it," says one customer.

Almost everyone who has visited a doctor's office, picked up a prescription or checked into a hospital in the last three months has noticed changes—some subtle, some strange, some irritating—attributed to the country's new medical privacy rule.

The comprehensive rule, which took effect in April after years of debate and scores of hearings, marks a sea change in America's health care system.

Mandated by the 1996 Health Insurance Portability and Accountability Act, known as HIPAA, the rule touches virtually everyone in the medical community.

"This is the first federal law to protect medical privacy," says Janlori Goldman of the Health Privacy Project, an advocacy group in Washington. "Every doctor's office, every hospital, every pharmacy, every health plan now has to build privacy protections into how they do business."

Safeguards run the gamut—from privacy screens for computers and locks for file drawers to the velvet rope in the drugstore. In Omaha, Neb., a group of health clinics reportedly turned up the volume on the music piped into waiting rooms so medical conversations could not be overheard.

The rule also lists new patient rights, including the right to know who sees your medical files and the right to see, copy and amend your own medical records. [See Medical Privacy—What Are Your Rights?]

And the rule closes some privacy loopholes. "Now, if a marketing company or, more likely, an employer wants access to your medical files you can decide whether to give permission," says Rick Campanelli, director of the Office for Civil Rights, which monitors compliance for the U.S. Department of Health & Human Services (HHS).

Those who violate the law could face steep fines and prison.

Policymakers hope the new rule will help protect the confidentiality of medical conversations and safeguard sensitive medical data, such as records of abuse, mental illness and genetic information.

In the first few months of this massive shift, hitches, glitches and misunderstandings have been inevitable. In fact, some health care providers are erring so far on the side of caution "they in essence are making up their own rules," says Goldman of the Health Privacy Project.

She points to reports that doctors have refused to fax medical records to other doctors and hospitals have refused to give relatives information about a patient, erroneously citing the new privacy rule.

"The law says exactly the opposite," Goldman says. "The presumption is you talk to relatives and share information about a patient's condition unless the patient specifically asks you not to."

As for faxing records to a hospital or doctors treating the patient, the law clearly states that no special consent is required to share medical information for treatment, payment or health operations, says Campanelli of HHS. "We are trying to protect privacy, not erect barriers to health care," he says.

For many Americans, their introduction to the privacy rule begins with new paperwork to sign—which some find annoying.

The law requires health care providers to give patients a notice detailing their privacy rights and explaining who will have access to their medical records—from researchers and students to public health officials.

While some providers have told patients they won't treat them unless they sign the privacy notice, that is not the law. "There is no legal requirement that a patient sign the form," Goldman says. Providers are simply asked to make a good faith effort to get patients to acknowledge they have seen the notice.

Patients are asked to read and sign a privacy notice only when they begin a medical relationship. "A lot of this paperwork is one time," says Peter Swire, a law professor at Ohio State University who was the White House coordinator for the privacy rule in 1999-2000.

He says while the privacy notice makes some impatient, "in some ways it's a good reminder that something's changed. It sends a signal that the new privacy rules are in place."