8 ms·
Why do shared hospital rooms not violate HIPAA?
- ceejayoz 3y agoThis is why "code is law" as a crypto meme was a little silly. Law is often intentionally flexible!
- ajsnigrutin 3y agoMeh, just one more if() needs to be added :)
- Quekid5 3y agoI think you can drop the "often". Law must almost by definition be flexible because there are so many things in life that aren't as simple 'yes' or 'no'.
- deleted 3y ago[deleted]
- cypress66 3y agoI'd actually come to the opposite conclusion here. Unless you think this violation of privacy is OK?
- ceejayoz 3y agoI think this violation of privacy strikes the correct balance. Hospitals (especially ERs) are already quite full on a regular basis; making every room private would do substantial physical harm to many patients who'd wait much longer for treatment or have to forgo it entirely. (Perfect privacy would also require soundproofed rooms for phone calls, mantrap doors for patient rooms so you can't get an inadvertent peek while walking by, and probably dozens of other expensively impractical mitigations.) HIPAA requires "reasonable safeguards" to permit this sort of balance to be struck.
- cypress66 3y agoJust make all rooms private and build more rooms or hospitals. It's not rocket science. Relative to the already absurdly high health care costs, the construction costs should be pretty small.
- ceejayoz 3y ago> build more rooms or hospitals. It's not rocket science The hospitals near me have been expanding as fast as they can. Absolutely constant large-scale construction. It's not rocket science, but it's not a Thanos finger snap either.
- talldatethrow 3y agoCar dealership customers are always worried about their data. And rightfully so. The typical car salesman has 15 credit applications in his desk, 5 in his car in some folders he forgot about, 1 in the trash can he accidentally crinkled up instead of putting in the shred box. The managers office is even worse. The finance guys office is even worse. The 'business office' is half decent because the GM/owner is up there often. On a side note, my friend subleased an office from a medical nurse temp agency/employment agency. When he arrived (I helped him move in), there were thousands of unsecured files with people's socials and all info needed to get a job in file cabinets. The office had cleaning service every night from a random cleaning company.
- dahwolf 3y agoBecause that would be unreasonable and impractical. Next question please.
- deleted 3y ago[deleted]
- paxys 3y agoIt is legal because you are agreeing to it. Otherwise get up and leave.
- ceejayoz 3y agoYou can't agree to OHSA violations, or to a sub-minimum wage. A hospital conditioning treatment on a HIPAA waiver having been signed will quickly find itself the subject of regulatory scrutiny. I went to war with a doctors' office that claimed their non-compete clause meant I couldn't transfer my medical records to a doctor who'd left the practice I wanted to follow.
- robbiep 3y agoThat a doctors office can have a non-compete boggles the mind
- jonas21 3y agoI assume the non-compete agreement was between the doctor and the practice, which seems somewhat reasonable.
- deleted 3y ago[deleted]
- ceejayoz 3y agoYes. They took the position that their non-compete (and our general "we agree to clinic practices") with their doc took precedence over our HIPAA rights, which NY... disabused them of.
- paxys 3y agoA paper that says "I agree to a sub minimum wage" is illegal. One that says "I agree to share my medical info with XYZ" is not. Every hospital already makes you sign this when you are admitted, otherwise they wouldn't be able to function.
- ShakataGaNai 3y agoBecause health privacy is not ALWAYS HIPAA. In fact, it's almost never HIPAA... except for the fact that some Karen's learned the term HIPAA and now they think it's always HIPAA [1]. Unless it's digital health record-related, then it's probably HIPAA. If you're really curious, you can read HIPAA [2] and HITECH [3]. Combined, they are about 600 pages of dense dense legalese. [1] https://www.hipaajournal.com/is-it-a-hipaa-violation-to-ask-for-proof-of-vaccine-status/ https://www.hipaajournal.com/is-it-a-hipaa-violation-to-ask-... [2] https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW... [3] https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-1...
- owenmarshall 3y agoOne of the easiest questions to ask of someone who shouts “HIPPO violation!” is “covered entity or business associate?” “Yes, Dunkin Donuts can give you a free donut if you show your Covid vaccination card. No, the donut shop is not a covered entity or a business associate, so they aren’t bound by HARPO.”
- kstrauser 3y agoFrom https://www.hipaajournal.com/what-does-hipaa-cover/ https://www.hipaajournal.com/what-does-hipaa-cover/ > The HIPAA Privacy Rule applies to all forms of health information, including paper records, films, and electronic health information – even spoken information. HIPAA is not as limited as you state.
- vidanay 3y agoWhy do the paper thin walls between exam rooms at my doctor's office that allow me to hear entire conversations while I am waiting (and waiting) not violate HIPAA?
- burnte 3y agoReasonable precautions. I've been top IT management in healthcare for 8 years, I'm very well versed with this concept. HIPAA isn't "PHI is Eyes Only Secret!" it's "you have to take reasonable precautions to safeguard data from bad actors." I have a wall between the rooms, each room has doors, and when the doc is talking with you, you can't hear a lot from the next room over. We don't have to make walls soundproof and doors sealing airlocks.
- supertrope 3y agoClinics that deal with the most sensitive medical needs tend to be more careful. HIV testing, reproductive health, psychiatry, hospice.
- NoZebra120vClip 3y ago[flagged]
- dang 3y agoPosting like this will get you banned again. No more of it please, regardless of how right you are or feel you are. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- anderiv 3y agoThis was not a productive, nor necessary comment. Please retract it and take it elsewhere. It has no place on HN.
- NoZebra120vClip 3y ago[flagged]
- amelius 3y agoBecause by walking into the hospital, you already gave away the info to any bystander. And all variations thereof.
- ceejayoz 3y agoIf you're coming in for a disembowlement, sure, but even then you're only really revealing the condition; your name, history, insurance details etc. are still private information. (The hospital would also still be forbidden from, say, publishing "amelius came in today with with a minor disembowlement" without your permission, no matter how public it was in the waiting room.)
- Quekid5 3y agoIn the waiting room they usually don't shout out "Geoff, who's here for the cock wart, the doctor will see you now"... they just say "Geoff, the doctor will see you now." Btw, my name's not Geoff. (Just to be a bit more plain.)
- macksd 3y agoThe top comment here is very reasonable, but I still think the application of HIPAA has been a giant mess, reflecting a disdain toward patients similar to everything else in the US healthcare system. I've ranted on here plenty about how often I've dealt with incorrect bills, and HIPAA plays into that as well. My private information can be shared to "traveling doctors", it can be shared with woefully incompetent contractors who handle billing (or, pretend to), and I received a notice last year that my information had been involved in a data breach and I'm not expecting any compensation. When I had to get a very private and sensitive part of my body imaged, they'll gladly announce to the waiting room my name and what procedure I'm there for, even though it's a rather private and sensitive part of my body - very similar to the shared room concern. I don't care that the people in that room aren't likely to misuse my healthcare information, I don't want them knowing where I found a lump anyway. And yet HIPAA is often cited to me over the phone as the reason why we can't seem to get incorrect bills figured out for my dependents. It doesn't seem to me that HIPAA actually does much to protect my privacy, but it sure gets used to obfuscate things when there's a problem.
- jliptzin 3y agoI once went to the dermatologist, the doctor left the room briefly and had the computer screen open with everyone’s full name and reason for the visit that day…could see who was there for genital warts, Botox, etc. I don’t think anyone should expect that their health info remains private at any point
- catchnear4321 3y agotwo seconds to clear the screen. a few dollars for a privacy shield. your doctor was more than a little careless and, knowingly or not, relied on you to not cross any lines. if that’s not concerning to you, fantastic… but for some reason you didn’t name the doctor, perhaps because you know others disagree. nor did you name the patients. huh. guess your doctor made a safe assumption about you. who else saw the warts list that day?
- DoreenMichele 3y agoWhat your doctor did is actually a HIPAA violation. He's a covered entity and securing computer screens is a standard precaution for such. In reality, a lot of doctor's offices are not well versed in HIPAA because many are de facto small businesses. Large hospitals and insurance companies generally have better knowledge of HIPAA and HIPAA compliance.
- 1-6 3y agoI have a domain name that's similar to a medical facility. Sensitive medical data gets emailed to the wrong recipient all the time and it's usually operator error.
- RajT88 3y agoI used to work for a company which made EHR systems, and there was one product which distributed client software updates via email. As in, they would attach an *.msi file and send it. It was a weird conversation, where we both ended up looking at each other like the other one was a total moron.
- vasco 3y agoMy name and domain is similar to a huge transportation company so I frequently get quotes for big jobs, plus times and dates for large truck shipments.
- dylan604 3y agoThis might be advantageous if you are also receiving inventory for these shipments if you're the type to make that information available to interested parties
- _jal 3y agoDitto, only my domain is unfortunately similar to a major (non-us) airline. The tarmac reports can be oddly entertaining sometimes. I still wonder how an alcohol bottle became embedded in a runway a few years back.
- deleted 3y ago[deleted]
- anonu 3y agoHIPAA is sort of a joke to me. My perspective being that of a patient. Any doctor's office just blindly asks you sign a HIPAA authorization release form. Most patients don't realize that you have a choice to "opt out" and not sign it. But even then it doesn't matter because under HIPAA the provider may still choose to share your personal information for their own reasons. Sure, I am doing a lot of "hand waving"- I'm not an expert on the law. I'm merely sharing my perspective on this. Would love to understand more about this specific authorization...
- ceejayoz 3y ago> Any doctor's office just blindly asks you sign a HIPAA authorization release form. I've never been asked to waive my rights. I have been asked to sign that I received their notice of privacy practices. (Almost always having not been actually given any to read, which is fairly infuriating.) > But even then it doesn't matter because under HIPAA the provider may still choose to share your personal information for their own reasons. Only in certain specific situations.
- appleflaxen 3y ago> Any doctor's office just blindly asks you sign a HIPAA authorization release form. You are incorrect. You are being asked to acknowledge that you received a copy of their privacy policies. You can decline and it doesn't change very much (if anything), because they will still document that they informed you of them... which they did. It's understandable that people don't read what they're signing; I often don't have time, either. But you are posting about that form having not paid much attention to it, which is less common, in my experience.
- kemotep 3y agoAny HIPAA authorization form I have signed has had me spell out who is allowed to have access to my records, like my wife or another Doctor’s office. Did you read what you signed?
- deleted 3y ago[deleted]
- dangle1 3y ago
- swayvil 3y agoMy friend spent the night in the hospital recently, for observation. She didn't sleep a wink. With all the beeping and alarms and periodic checks and procedures. Mostly involving her roommate. The next morning she was mentally and physically wrecked. the first thing she told the nurse was, "I want to go home so I can get some sleep. The nurse laughs and replies, "I hear that all the time. Nobody ever sleeps here". Now that's messed up. Sleep is the great healer. No sleep is the great destroyer. Is this intentional or institutional insanity or what? I mean why don't they just put strychnine in the water supply while they're at it?
- ceejayoz 3y agoThe beeping and alarms and periodic checks and procedures are there to prevent worse things than a night's worth of lost sleep.
- tekla 3y agoAn overnight stay is for observation not comfort. The hospital wants to gather as many metrics as possible to keep you alive, respond ASAP to issues and dis-chargable to free up room for other sick patients. not give you a hotel bed.
- swayvil 3y agoGo to the hospital healthy, come out sick. I don't have a medical degree or anything but that's crazy. (Also, the nurse said nobody sleeps here. Not just the people under observation.)
- lifeisstillgood 3y agomy favourite part of the "reasonable precautions" explanation is the possibility that if you are a known PHI leaker, the hospital might have to segregate you - (or even be able to refuse treatment) weird
- armchairhacker 3y agoHow does HIPAA compare to FERPA? My understanding is that FERPA is similar to HIPAA, except for college scores and enrollment information instead of medical records. But there’s a rule in FERPA where you explicitly can’t leave a stack of exams and let students pick them, because it exposes students to others’ scores. Another rule is that you can’t associate a students exam with their student ID even if it’s a sequence of numbers, because the id is public information, but you wouldn’t expect someone to remember someone else’s id. (I specifically remember some professors not following the exam rule, probably because they didn’t know or perhaps it didn’t exist yet. I don’t know if anything happened to them but I suspect if anything, they were simply asked to not do that in the future.)
- vasco 3y agoI recently learnt on HN that some countries don't publish grades to ALL students at once and still can't think why. It's such an amazing gift to be able to see how much everyone got and the academic competition in its most pure form, while removing some awkwardness of getting results of your work (good or bad) early in your life. People are too focused on hiding results because someone might feel bad.
- armchairhacker 3y agoMost classes. publish grade distributions, so you know if you were in the top or bottom 10%. Or at least the mean, median, highest, and lowest. But you don’t get the grades of individuals.
- kube-system 3y agoWhile things like FERPA broadly protect most student information in the US, it doesn't exist so that people don't feel bad about their test scores. It limits schools and their staff to using student data for legitimate academic purposes and prohibits other uses that could be bad. That data goes beyond just test scores and could be things related to the students health, social life, behavior, etc. This kind of data doesn't need to shared with anyone that doesn't need to know it.
- 3y ago
- dtnewman 3y agoFrom the HHS.gov website: The Privacy Rule permits certain incidental uses and disclosures that occur as a by-product of another permissible or required use or disclosure, as long as the covered entity has applied reasonable safeguards and implemented the minimum necessary standard, where applicable, with respect to the primary use or disclosure. See 45 CFR 164.502(a)(1)(iii). An incidental use or disclosure is a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a result of another use or disclosure that is permitted by the Rule. However, an incidental use or disclosure is not permitted if it is a by-product of an underlying use or disclosure which violates the Privacy Rule.
- bigmattystyles 3y agoI mean, they usually have a little curtain - I suppose that counts as reasonable.
- deleted 3y ago[deleted]
- mzs 3y agoguidance to the question itself: https://www.hhs.gov/hipaa/for-professionals/faq/197/must-facilities-have-private-or-soundproof-rooms/index.html https://www.hhs.gov/hipaa/for-professionals/faq/197/must-fac...
- buildsjets 3y agoThe P in HIPAA stands for Portability, not Privacy. The primary purpose of HIPAA is not to prevent the sharing of confidential patient data, it is to ENABLE the sharing of confidential patient data with anyone who has the right to see it. The issue is the number of entities who claim that they have right to see the data, and the lack of a mechanism for the individual to prevent their information from being shared. Should Facebook have a right to access your health data? Your opinion does not matter, they wanted it, and they got it. What about the US Department of Transportation? They maintain the right to access the electronic medical records of any person who falls under their regulation, such as pilots and truck drivers. They have been know to go on fishing expeditions trolling through medical records in search of violations. Search for Operation Safe Pilot. I know several people who have either avoided medical treatment because of this issue, or obtained treatment in a foreign country.
- deathanatos 3y agoI work in healthcare; these views are my own, and IANAL. > The P in HIPAA stands for Portability, not Privacy. … sure, that P stands for that. But one of the key sections is literally called the Privacy Rule: "The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information" > Should Facebook have a right to access your health data? Your opinion does not matter, they wanted it, and they got it. No. Wantonly sharing PHI with Facebook would almost certainly be a violation of HIPAA … and literally, it's already happened, this year even[1]: "The office warned that entities covered by HIPAA aren’t allowed to wantonly disclose HIPAA-protected data to vendors or use tracking technology" ("Vendors" here included Facebook and the like.) ¹ Now, HIPAA only applies to covered entities. In the context of the OP however, a hospital is a covered entity. Whether eavesdropping is permissible is a good question. [1]: https://www.politico.com/news/2023/04/17/health-industry-data-privacy-00092447 https://www.politico.com/news/2023/04/17/health-industry-dat... ¹I think regulatory agencies across the board have been giving pittances for fines, and these are no exception. There's a real question as to whether enforcement is actually meaningful, but that's separate question from whether there is a right.
- 3y ago
- tptacek 3y agoIt's easier to make sense of when you remember the original purpose of HIPAA, which was cost control and portability (that's what the 'p' stands for!). The confidentiality rules in HIPAA are part of (IIRC, I think, etc?) the "Administrative Simplification" section, which was about standardizing electronic health care records and making them available to the government for combating Medicare fraud. The law wasn't a sweeping medical privacy bill; it added privacy rules to mitigate concerns people had about centralizing medical records as part of its major purpose.
- dclowd9901 3y agoWhich sucks because there is tremendous value in anonymized collections of health records, yet we can’t use these health records for research at all. I realize it was out of scope for the bill, but damned if it didn’t stymie medical research to a ridiculous degree.
- mr_toad 3y agoAnonymised collections of health records are available to bona fide researchers.
- kccqzy 3y agoAnonymization is hard. Unless you have very accomplished cryptographers defining and implementing anonymization, I do not trust it. That basically means not trusting anyone but large governments and FAANG companies. That said I do think agencies like NIST should define anonymization standards.
- fardo 3y agoThe second comment feels closer to the mark. While post-hoc justifications could be made as to why a rule at least in spirit seemingly about patient privacy ignores an obvious and glaring privacy flaw, if the parties involved could be so honest, the real-world answer why it’s allowed would probably be > “It would be extraordinarily inconvenient and expensive for it to work otherwise.” Sprinkle on a little bureaucrat-ese and post-hoc justification and you get the “clarified guidance” the primary comment calls out
- deleted 3y ago[deleted]
- tptacek 3y agoIt's about the confidentiality of electronic medical records, not about patient privacy.
- fardo 3y agoIf we’re discussing > What is the motivation behind keeping medical records confidential, why do we actually care? A respect for the patient’s privacy is likely going to be one of the driving reasons, if not the primary reason itself.
- tptacek 3y agoNo, that's not the actual reason! The reason the rule exists is because, when HIPAA was passed, electronic patient health records were a new thing, and they were desired both for cost savings (electronic records as a way to drive administration costs down were a huge thing in the 1990s) and so the USG could combat Medicare fraud. The confidentiality rule was designed to ease the acceptance of electronic records; that's all. That's why the rule refers to e-PHI.
- fardo 3y agoYou’re correct regarding historical procedure, but with regards to the privacy rule, which was added shortly after its creation and at least online is much of why the act is known and discussed today, the rule exists to, quoting the government’s description, > The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization. We allow a major hole here in that protected health information by willfully careful readings of “appropriate safeguards” and “limits and conditions”, essentially because doing otherwise would be a nightmarish expense and pain.
- andrewguy9 3y agoBecause that would be expensive.
- deleted 3y ago[deleted]
- pierat 3y agoSpeaking of that, hospitals still use tons of POCSAG (pagers) and splatter medical everything over those. Course it's illegal to listen due to a bullshit 1987 law... but trivial to do so with a RTL-SDR. One idea my nefarious side had was to get the med records of individuals and get the address's house cost, and send scary calls/text/messages shaking relatives down with scare-calls. (Or, get the info and get in league with overseas scammers who masquerade as the hospital, and take a cut from that. Would be relatively risky free.) Obviously I wouldn't do that. But it would be trivial to do. (Long story short, pager infrastructure needs destroyed.)
- titmouselucifer 3y agoI've had a career in hospital IT and operations. The challenge is finding a replacement that is as reliable and accessible as a pager. The replacement communications products out there have some nice features (managing on-call scheduling, interfacing with electronic health records, etc), but it only takes a handful of outages to get everyone to switch back to pagers "just in case."
- hooverd 3y agoI'm sure Oracle nee Cerner would develop Pager Millennium if you asked nicely enough.
- pierat 3y agoWell, I was being rather absolutist when I said to destroy pager infra. It should be messages like "Code red to room xyz with patientID #####" That would remove anything really actionable. Whereas I was seeing over FLEX: full name, address, room#, child abuser status, why they're there, medicines. It was fucking stupid, like fuck no.
- tastysandwich 3y agoSimilarly, it really irks me how little privacy there is at the chemist/pharmacist/drugstore (listing all synonyms for an international audience). If I have any questions, they're at the counter with 20 other patrons hearing everything about my medication. Then I take my medication to a separate counter for payment, which is staffed, usually, by a teenager working part-time. Great, now they know what medication I'm on. Imagine if I were picking up medication for a teenage son or daughter, and the teenager at the counter went to school with them?
- nexus7556 3y agoAt my local Walgreens they're pretty strict about this- they make people stand about 10ft back from the window while waiting. I have seen them ask people to move back if they start encroaching.
- NoZebra120vClip 3y agoOnce, and never again, I declared my desire to a front-desk nurse that I wished to record my session in an Urgent Care facility. She said no, that is prohibited, because it is a HIPAA violation. She was clearly smoking crack. Now I simply record surreptitiously.
- ceejayoz 3y agoA healthcare facility knowingly permitting recording on-premises may indeed be a HIPAA violation.
- NoZebra120vClip 3y ago78% false. Please do not discourage patients from exercising our rights and accessing our own PHI, like this crack-smoking nurse did to me. https://www.aetnainternational.com/en/about-us/explore/health-care/lifestyle-better-health/can-i-record-my-doctors-visit.html https://www.aetnainternational.com/en/about-us/explore/healt... https://www.alight.com/blog/can-patients-record-doctors-office-visits https://www.alight.com/blog/can-patients-record-doctors-offi... https://www.verywellhealth.com/secretly-recording-your-doctors-appointments-4145786 https://www.verywellhealth.com/secretly-recording-your-docto... You've got to understand: clinic visits are very stressful, time-limited, and high-pressure. Doctors don't write anything down, but it's crucial that the patient rememberd everything that was said, with high accuracy and confidence. Audio recording is our best tool to these ends. I'm glad I don't live in California!
- ceejayoz 3y agoThe problem isn't your PHI, nor is it a legal problem for you. The problem is them knowingly permitting you to record in a situation where you may capture someone else's PHI. (As in the "shared hospital rooms" example we're in a discussion thread of.) You've also mixed up what's legal for you to do (record, in a single-party state) and what's legal for them to permit by policy (knowingly agreeing to recording). You won't get arrested in a single-party state for recording; it can still violate the clinic's policy, and they can make the decision not to continue doing business with you after. No one's going to stop you from writing down a note, though. Thinking "doctors don't write anything down" is universal may indicate you need a better one; mine definitely does, and I get sent the summary shortly after my visits.
- voicedYoda 3y agoOne of the interesting rules of HIPAA is that if it starts analog, it doesn't have to conform to encryption technologies, i.e. phone calls and fax machines don't require the complexities a digital system, like an electronic medical record, require. When HIPAA was created, a large impetus was getting large health systems onto electronic records. Portability and accountability reigned high. And there's a lot of information and misinformation about this. Attorney general letters help clarify a lot of it. But sharing a hospital room doesn't violate anything related to HIPAA because that isn't what the law protects.
- mshaler 3y agoThe house (insurance companies) always wins