3 ms·

But I never gave Milliman permission to hold this data, so didn't they already violate HIPAA?

by SamBam 7y ago

astura 7y ago
Sounds like they have hooks into the back end systems to query multiple insurance companies and pharmacies on the fly. - "Milliman instantly gathers information from multiple data sources"
sethbannon 7y ago
Likely deep within the terms and conditions you agreed to with your private health insurance company, you did indeed give permission.
nosuchuser2 7y ago
I think you misunderstand HIPAA. As long as they have a business associate agreement with the pharmacies and serve some vaguely care-adjacent purpose, the pharmacy can share your data with them without your knowledge or consent.
- SamBam 7y ago
  I can't tell if you're being cynical or serious, but if the latter I can't see how this is correct. From "Pharmacy privacy Requirements here [1], I don't think "business associate agreement [with] some vaguely care-adjacent purpose" meets the standards for information-sharing. Rather the information must be being shared as part of specific treatment for a patient (discussing actual care) or payment. [1] https://www.uspharmacist.com/article/hipaa-privacy-security-and-pharmacy-information-technology https://www.uspharmacist.com/article/hipaa-privacy-security-...
  - rlucas 7y ago
    GP comment is being deadly serious and not at all cynical or sarcastic. HIPAA is a fig leaf. Cardboard covers on clipboards to inconvenience the nurses and receptionists, but a unencumbered infobahn for anyone who touches the money to drive straight through. For decades, every visit, test, procedure, and medication you've ever had paid for by a health insurer in the US got dumped straight into MIB, where any insurer could look at it. HIPAA functionally changed this not a whit.
  - jklein11 7y ago
    > HIPAA has a rule that permits disclosure of PHI for health care operations, treatment, and payment. I think this is what the GP was referring to. It's not just for care but for payment and operations too. A few operational examples, in the case of pharmacies, they must make sure that a patient doesn't fill the same prescription twice. Health insurance companies receive clinical data from health care providers for the purposes of HEDIS reporting. Don't forget, the second P in HIPPA is portability.

But I never gave Milliman permission to hold this data, so didn't they already violate HIPAA?

by SamBam 7y ago

But I never gave Milliman permission to hold this data, so didn't they already violate HIPAA?

Sounds like they have hooks into the back end systems to query multiple insurance companies and pharmacies on the fly. - "Milliman instantly gathers information from multiple data sources"

sethbannon 7y ago

Likely deep within the terms and conditions you agreed to with your private health insurance company, you did indeed give permission.

nosuchuser2 7y ago

I think you misunderstand HIPAA. As long as they have a business associate agreement with the pharmacies and serve some vaguely care-adjacent purpose, the pharmacy can share your data with them without your knowledge or consent.

SamBam 7y ago
I can't tell if you're being cynical or serious, but if the latter I can't see how this is correct. From "Pharmacy privacy Requirements here [1], I don't think "business associate agreement [with] some vaguely care-adjacent purpose" meets the standards for information-sharing. Rather the information must be being shared as part of specific treatment for a patient (discussing actual care) or payment. [1] https://www.uspharmacist.com/article/hipaa-privacy-security-and-pharmacy-information-technology https://www.uspharmacist.com/article/hipaa-privacy-security-...
- rlucas 7y ago
  GP comment is being deadly serious and not at all cynical or sarcastic. HIPAA is a fig leaf. Cardboard covers on clipboards to inconvenience the nurses and receptionists, but a unencumbered infobahn for anyone who touches the money to drive straight through. For decades, every visit, test, procedure, and medication you've ever had paid for by a health insurer in the US got dumped straight into MIB, where any insurer could look at it. HIPAA functionally changed this not a whit.
- jklein11 7y ago
  > HIPAA has a rule that permits disclosure of PHI for health care operations, treatment, and payment. I think this is what the GP was referring to. It's not just for care but for payment and operations too. A few operational examples, in the case of pharmacies, they must make sure that a patient doesn't fill the same prescription twice. Health insurance companies receive clinical data from health care providers for the purposes of HEDIS reporting. Don't forget, the second P in HIPPA is portability.