It's pretty obvious to tech-aware medical practitioners that the official rules governing health information don't cover the full gamut of circumstances clinici

It's pretty obvious to tech-aware medical practitioners that the official rules governing health information don't cover the full gamut of circumstances clinicians deal with. The article discusses certain genetic tests not directly ordered as medical procedures, that is, "OTC" testing done for example by 23andMe, etc, that lack HIPAA protections. In principle, this could result in health data being misused, e.g., to profile ads geared toward the individual. As well, genetic testing services marketed to providers (e.g., to identify liver enzymes that clear medications from circulation) may fall into a gray zone. I'm not sure about a range of non-standard nutritional or food allergy tests on the market re: HIPAA compliance. A big concern is the adequacy of EHR system security even if HIPAA rules are followed. The numerous intrusions into health insurers and hospital systems show the vulnerabilities that HIPAA doesn't really prevent. Threat of data "leakage" makes clinicians wary about what info is recorded, and in private conversations tell me they often don't include "personally sensitive" info in the record. The opinion of these practitioners is the convenience of EHR "interoperability" will likely reduce privacy protections HIPAA is supposed to provide. Perhaps this expresses more about the state of system security in general vs. HIPAA deficiencies, nonetheless HIPAA needs to be strengthened to really keep health data private and out of the hands of corporate or governmental exploitation.