5 ms·

How is that not illegal due to the simple fact that you are disclosing to a third party who your patients are?

by zAy0LfpBZLC8mAC 9y ago

jlarocco 9y ago
How?
- bluejekyll 9y ago
  I suppose they mean through search history and the fact that google and other search engines would have access to that.
  - zAy0LfpBZLC8mAC 9y ago
    The question of "history" really is secondary here. What's forbidden is not that people you tell information about your patients write it down, what is forbidden is telling them in the first place.
- zAy0LfpBZLC8mAC 9y ago
  By typing it into their search form and sending it to their server, and especially on "social networks" by the further (non-)interaction with the person?
  - jlarocco 9y ago
    When a person searches for another person's name, I don't think there's any way for Google to know what the connection is between those people.
    - zAy0LfpBZLC8mAC 9y ago
      Imagine you were a sort of "librarian of world-wide knowledge" that people would call to ask all kinds of questions they had. Imagine there were this one person who asked you a lot of questions about all kinds of mental health problems, and then also quite a lot of names of people, in particular during working hours. Are you telling me you wouldn't possibly get the idea from that that a significant proportion of those people would be their patients? Or are you saying that as long as there is no absolute certainty, sharing of medical info is perfectly fine? So, there shouldn't really be a problem with a doctor publishing the medical file of a patient in the local newspaper ... after all, how should the reader be certain that it's not just a fake of someone the doctor doesn't even know?
  - true_religion 9y ago
    HIPAA rules specifically permit incidental disclosures that accompany a permitted purpose such as relating to safety, patient communication, or health treatment, including payment. If your doctor has a reasonable reason to Google a patient beyond mere curiosity, HIPPA would allow the search to take place because the revelation of a name is considered a 'minor' disclosure, and was incidental and as minimal as possible. If HIPPA didn't have such exclusions, merely calling a patient by name in a crowded waiting room would be a violation.
    - zAy0LfpBZLC8mAC 9y ago
      > HIPAA rules specifically permit incidental disclosures that accompany a permitted purpose such as relating to safety, patient communication, or health treatment, including payment. I think those really are very different cases. For example, telecommunication is protected by other laws. So, yes, a doctor may call you and even speak into their telephone about your medical information, thus effectively transmitting that information to their telco, but then, telecommunication providers are not allowed to listen to calls or use the contents for marketing purposes, or whatever. > If your doctor has a reasonable reason to Google a patient beyond mere curiosity, HIPPA would allow the search to take place because the revelation of a name is considered a 'minor' disclosure, and was incidental and as minimal as possible. First of all, it's not just the name being disclosed, it's the link to the doctor that's being disclosed. And the question is: Well, was it minimal? How do you determine that? And was it incidental? What are the criteria? Imagine a doctor called everyone in their city, asking them if they knew anything about their patient. Not out of curiosity, but because they are trying to get a better understanding of the medical situation of their patient. They are only disclosing the name, so it's a minor disclosure, right? And also, it was just incidental, right? They didn't call to tell everyone who their patient is, they called in order to collect information they thought could help them! Now, how exactly is that actually different from asking google? The number of humans involved? What if you hired a detective to collect information on your patient? At least, you then could put confidentiality clauses into the contract, instead of giving the information to a company where your use of the service implies accepting some TOS that allow that company to essentially use the information to make money in any way the like! > If HIPPA didn't have such exclusions, merely calling a patient by name in a crowded waiting room would be a violation. Well, that doesn't seem like a particularly convincing argument to me. They are physically present and essentially identifiable to the other people in the room anyway, and essentially due to their own decision to go there. So, yeah, there probably is a need for exclusions that allow this, but that example doesn't really help with figuring out where the limits are or should be.
drdaeman 9y ago
I think it's not that simple. Telling that John Doe is your patient is still different from just asking "you know John Doe?". The latter only discloses the fact that you know the name, and the rest isn't a certainty. For example, if a doctor searched for their patient's name once and haven't ever searched for any other patient, but have searched for, e.g., a family member or a friend - it probably doesn't disclose enough information to be a privacy violation. If doctor looks up every patient they have, it's obvious they're leaking that data and if the laws forbid this level of disclosure - they should be held accountable. The article suggests something in between - so I don't think it's obvious whenever it's legal or not. It's likely to be not (in a real-world scenario), but still... (And if doctor generates ton of random but real names and mixes in some patient names indistinguishably - it's probably okay, haha. Of course, that's not what happens, either.)
- zAy0LfpBZLC8mAC 9y ago
  > I think it's not that simple. Yeah, I absolutely agree. But I guess my point is: It's not as simple as "well, if the information is not 100% certain, it's fine" either.

How is that not illegal due to the simple fact that you are disclosing to a third party who your patients are?

jlarocco 9y ago

How?

bluejekyll 9y ago
I suppose they mean through search history and the fact that google and other search engines would have access to that.
- zAy0LfpBZLC8mAC 9y ago
  The question of "history" really is secondary here. What's forbidden is not that people you tell information about your patients write it down, what is forbidden is telling them in the first place.
zAy0LfpBZLC8mAC 9y ago
By typing it into their search form and sending it to their server, and especially on "social networks" by the further (non-)interaction with the person?
- jlarocco 9y ago
  When a person searches for another person's name, I don't think there's any way for Google to know what the connection is between those people.
  - zAy0LfpBZLC8mAC 9y ago
    Imagine you were a sort of "librarian of world-wide knowledge" that people would call to ask all kinds of questions they had. Imagine there were this one person who asked you a lot of questions about all kinds of mental health problems, and then also quite a lot of names of people, in particular during working hours. Are you telling me you wouldn't possibly get the idea from that that a significant proportion of those people would be their patients? Or are you saying that as long as there is no absolute certainty, sharing of medical info is perfectly fine? So, there shouldn't really be a problem with a doctor publishing the medical file of a patient in the local newspaper ... after all, how should the reader be certain that it's not just a fake of someone the doctor doesn't even know?
- true_religion 9y ago
  HIPAA rules specifically permit incidental disclosures that accompany a permitted purpose such as relating to safety, patient communication, or health treatment, including payment. If your doctor has a reasonable reason to Google a patient beyond mere curiosity, HIPPA would allow the search to take place because the revelation of a name is considered a 'minor' disclosure, and was incidental and as minimal as possible. If HIPPA didn't have such exclusions, merely calling a patient by name in a crowded waiting room would be a violation.
  - zAy0LfpBZLC8mAC 9y ago
    > HIPAA rules specifically permit incidental disclosures that accompany a permitted purpose such as relating to safety, patient communication, or health treatment, including payment. I think those really are very different cases. For example, telecommunication is protected by other laws. So, yes, a doctor may call you and even speak into their telephone about your medical information, thus effectively transmitting that information to their telco, but then, telecommunication providers are not allowed to listen to calls or use the contents for marketing purposes, or whatever. > If your doctor has a reasonable reason to Google a patient beyond mere curiosity, HIPPA would allow the search to take place because the revelation of a name is considered a 'minor' disclosure, and was incidental and as minimal as possible. First of all, it's not just the name being disclosed, it's the link to the doctor that's being disclosed. And the question is: Well, was it minimal? How do you determine that? And was it incidental? What are the criteria? Imagine a doctor called everyone in their city, asking them if they knew anything about their patient. Not out of curiosity, but because they are trying to get a better understanding of the medical situation of their patient. They are only disclosing the name, so it's a minor disclosure, right? And also, it was just incidental, right? They didn't call to tell everyone who their patient is, they called in order to collect information they thought could help them! Now, how exactly is that actually different from asking google? The number of humans involved? What if you hired a detective to collect information on your patient? At least, you then could put confidentiality clauses into the contract, instead of giving the information to a company where your use of the service implies accepting some TOS that allow that company to essentially use the information to make money in any way the like! > If HIPPA didn't have such exclusions, merely calling a patient by name in a crowded waiting room would be a violation. Well, that doesn't seem like a particularly convincing argument to me. They are physically present and essentially identifiable to the other people in the room anyway, and essentially due to their own decision to go there. So, yeah, there probably is a need for exclusions that allow this, but that example doesn't really help with figuring out where the limits are or should be.

drdaeman 9y ago

I think it's not that simple. Telling that John Doe is your patient is still different from just asking "you know John Doe?". The latter only discloses the fact that you know the name, and the rest isn't a certainty. For example, if a doctor searched for their patient's name once and haven't ever searched for any other patient, but have searched for, e.g., a family member or a friend - it probably doesn't disclose enough information to be a privacy violation. If doctor looks up every patient they have, it's obvious they're leaking that data and if the laws forbid this level of disclosure - they should be held accountable. The article suggests something in between - so I don't think it's obvious whenever it's legal or not. It's likely to be not (in a real-world scenario), but still... (And if doctor generates ton of random but real names and mixes in some patient names indistinguishably - it's probably okay, haha. Of course, that's not what happens, either.)

zAy0LfpBZLC8mAC 9y ago
> I think it's not that simple. Yeah, I absolutely agree. But I guess my point is: It's not as simple as "well, if the information is not 100% certain, it's fine" either.