4 ms·

Wouldn’t this be a massive HIPAA violation??

alexwilde 3y ago
The article covers this: The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement.
- bonestamp2 3y ago
  Wow, that's a gaping privacy loophole.
  - dekhn 3y ago
    HIPAA was never a law about privacy of medical data. It's a law that governs the management of medical data, with very limited protections for privacy. I think most people misunderstand that law, its purpose, and its implications.
  - ThinkingGuy 3y ago
    The P in HIPAA stands for "Portability," not "Privacy."
    - u32480932048 3y ago
      HIPPA is the Privacy act ;)
    - bonestamp2 3y ago
      Sure, but privacy has been a design consideration of HIPAA since 2003.
- yold__ 3y ago
  I work in this space, and your comment is completely wrong. Data covered by HIPAA is always covered by HIPAA. A covered entity would also include a health insurer, and all payment intermediaries, this is straight from the HHS faq (https://www.hhs.gov/hipaa/for-professionals/faq/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/faq/covered-enti...)
  - alexwilde 3y ago
    Did you read the article? I've read through what you've linked as well as this page: https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must-comply-with-hipaa-privacy-standards/index.html https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must... I'm not seeing anything that explicitly calls out Pharmacies.
    - yold__ 3y ago
      https://www.hipaajournal.com/hipaa-compliance-for-pharmacies/ https://www.hipaajournal.com/hipaa-compliance-for-pharmacies... The police are breaking federal law and the article is wrong. This is not a gray area.
      - alexwilde 3y ago
        I don't think you read the article or the links you provided. It clearly states the police are obtaining this information through subpoena and not warrants: In briefings, officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records. And in the link you provided: When might it be permitted for a pharmacy to disclose PHI to law enforcement officers? Bearing in mind that, once in a designated record set, PHI could be an individual´s name or physical description, a pharmacy (or pharmacy staff) is permitted to – but not required to – disclose PHI to law enforcement officers in the following six circumstances: as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests In this case, the leeway in the standard here is what the pharmacy chooses to comply with. They are choosing to comply with subpoenas. This article points out how that standard could be higher (warrants).
- dragonwriter 3y ago
  HIPAA law and implementing regs include broad allowances for disclosure to law enforcement, some of which involve some degree of subjective judgement on the part of the covered entity (and most of which do not require a warrant), but, no, it does not allow pharmacies (or any other covered entities) "leeway as to what legal standard they require" (emphasis added) before such disclosure. See, generally, https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe... and the regulations cited therein.
theGnuMe 3y ago
I look forward to the lawsuits since HIPAA is Federal and abortion laws are state.
- dragonwriter 3y ago
  Unfortunately for that idea, the law enforcement disclosures allowed under HIPAA are not limited to disclosures related to violations of federal law, or disclosures only to federal law enforcement.
Teever 3y ago
I'm in Canada so HIPAA doesn't apply for me but when I was going into my second year of university the student union signed a contract with a health insurance company that provided some piddly policy for students that was mandatory unless you could provide proof of insurance with another company. Not only was there no way to refuse this but you were automatically enrolled unless you could provide that proof by a certain date. I got into an argument with the student president about this because I considered it a massive overreach for the school to give my information to the student union who then turns around and gives it to a third party, and that this is just some how a part of completing post secondary education. He was adamant that it was both legal and ethical, and that there was no privacy violation that occurred. I ended up opting out in time but a few months later I received an email from the insurance company stating that they had been hacked and they weren't quite sure what information had been leaked. I've never found out what information was transmitted from the student union to the health insurance company, if the company managed to get access to my health records, or if that company has sold those records, or been acquired by a large company that has added those records to their collection, or what the hackers manged to steal. I guess this is all legal because some student union that gets less than 9% of the student body to vote for them said so?
- Ensorceled 3y ago
  > I'm in Canada so HIPAA doesn't apply for me But PIPEDA definitely applies to this situation, but PIPEDA only came into effect on April 2020 so it would depend upon when you were a student.
  - Scoundreller 3y ago
    Depends on province, you might be covered under a provincial regulation. PIPEDA takes effect if your province doesn't have a substantially similar law. PIPEDA came into effect in 2000.
- JohnFen 3y ago
  > He was adamant that it was both legal and ethical, and that there was no privacy violation that occurred. I could understand about it being legal, maybe even ethical (ethical codes can differ) -- but to argue that there is no privacy violation? That just seems completely delusional.
yold__ 3y ago
When you buy health insurance, you sign a temporary HIPAA release (limited duration) to cover the period that they are underwriting. They can only query your specific pharmacy records for the purposes of underwriting. So yes, this is a HIPAA violation when it is being used by the police. I work in this space with HIPAA data.
- paulmd 3y ago
  > So yes, this is a HIPAA violation when it is being used by the police. I work in this space with HIPAA data. It is not, because HIPAA includes an "official/governmental purposes" exemption. See exemption (5) https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... > Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).29 > Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.33 > Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34 > Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.41
heroprotagonist 3y ago
You can fit an astounding number of elephants through the loopholes in HIPAA: https://www.law.cornell.edu/cfr/text/45/164.512 https://www.law.cornell.edu/cfr/text/45/164.512 And then there's the HHS interpretation of the above for providers, which is... porous: https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe... Of particular note are the exemptions in 45 CFR 164.512(k)(2) applicable to powers granted by executive order 12333 (on mass surveillance). When this exemption is used it makes discovering whether, when, how, or why your data was collected or used practically impossible.

The article covers this: The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement.

bonestamp2 3y ago
Wow, that's a gaping privacy loophole.
- dekhn 3y ago
  HIPAA was never a law about privacy of medical data. It's a law that governs the management of medical data, with very limited protections for privacy. I think most people misunderstand that law, its purpose, and its implications.
- ThinkingGuy 3y ago
  The P in HIPAA stands for "Portability," not "Privacy."
  - u32480932048 3y ago
    HIPPA is the Privacy act ;)
  - bonestamp2 3y ago
    Sure, but privacy has been a design consideration of HIPAA since 2003.
yold__ 3y ago
I work in this space, and your comment is completely wrong. Data covered by HIPAA is always covered by HIPAA. A covered entity would also include a health insurer, and all payment intermediaries, this is straight from the HHS faq (https://www.hhs.gov/hipaa/for-professionals/faq/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/faq/covered-enti...)
- alexwilde 3y ago
  Did you read the article? I've read through what you've linked as well as this page: https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must-comply-with-hipaa-privacy-standards/index.html https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must... I'm not seeing anything that explicitly calls out Pharmacies.
  - yold__ 3y ago
    https://www.hipaajournal.com/hipaa-compliance-for-pharmacies/ https://www.hipaajournal.com/hipaa-compliance-for-pharmacies... The police are breaking federal law and the article is wrong. This is not a gray area.
    - alexwilde 3y ago
      I don't think you read the article or the links you provided. It clearly states the police are obtaining this information through subpoena and not warrants: In briefings, officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records. And in the link you provided: When might it be permitted for a pharmacy to disclose PHI to law enforcement officers? Bearing in mind that, once in a designated record set, PHI could be an individual´s name or physical description, a pharmacy (or pharmacy staff) is permitted to – but not required to – disclose PHI to law enforcement officers in the following six circumstances: as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests In this case, the leeway in the standard here is what the pharmacy chooses to comply with. They are choosing to comply with subpoenas. This article points out how that standard could be higher (warrants).
dragonwriter 3y ago
HIPAA law and implementing regs include broad allowances for disclosure to law enforcement, some of which involve some degree of subjective judgement on the part of the covered entity (and most of which do not require a warrant), but, no, it does not allow pharmacies (or any other covered entities) "leeway as to what legal standard they require" (emphasis added) before such disclosure. See, generally, https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe... and the regulations cited therein.

theGnuMe 3y ago

I look forward to the lawsuits since HIPAA is Federal and abortion laws are state.

dragonwriter 3y ago
Unfortunately for that idea, the law enforcement disclosures allowed under HIPAA are not limited to disclosures related to violations of federal law, or disclosures only to federal law enforcement.

Teever 3y ago

I'm in Canada so HIPAA doesn't apply for me but when I was going into my second year of university the student union signed a contract with a health insurance company that provided some piddly policy for students that was mandatory unless you could provide proof of insurance with another company. Not only was there no way to refuse this but you were automatically enrolled unless you could provide that proof by a certain date. I got into an argument with the student president about this because I considered it a massive overreach for the school to give my information to the student union who then turns around and gives it to a third party, and that this is just some how a part of completing post secondary education. He was adamant that it was both legal and ethical, and that there was no privacy violation that occurred. I ended up opting out in time but a few months later I received an email from the insurance company stating that they had been hacked and they weren't quite sure what information had been leaked. I've never found out what information was transmitted from the student union to the health insurance company, if the company managed to get access to my health records, or if that company has sold those records, or been acquired by a large company that has added those records to their collection, or what the hackers manged to steal. I guess this is all legal because some student union that gets less than 9% of the student body to vote for them said so?

Ensorceled 3y ago
> I'm in Canada so HIPAA doesn't apply for me But PIPEDA definitely applies to this situation, but PIPEDA only came into effect on April 2020 so it would depend upon when you were a student.
- Scoundreller 3y ago
  Depends on province, you might be covered under a provincial regulation. PIPEDA takes effect if your province doesn't have a substantially similar law. PIPEDA came into effect in 2000.
JohnFen 3y ago
> He was adamant that it was both legal and ethical, and that there was no privacy violation that occurred. I could understand about it being legal, maybe even ethical (ethical codes can differ) -- but to argue that there is no privacy violation? That just seems completely delusional.

yold__ 3y ago

When you buy health insurance, you sign a temporary HIPAA release (limited duration) to cover the period that they are underwriting. They can only query your specific pharmacy records for the purposes of underwriting. So yes, this is a HIPAA violation when it is being used by the police. I work in this space with HIPAA data.

paulmd 3y ago
> So yes, this is a HIPAA violation when it is being used by the police. I work in this space with HIPAA data. It is not, because HIPAA includes an "official/governmental purposes" exemption. See exemption (5) https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... > Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).29 > Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.33 > Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34 > Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.41

heroprotagonist 3y ago

You can fit an astounding number of elephants through the loopholes in HIPAA: https://www.law.cornell.edu/cfr/text/45/164.512 https://www.law.cornell.edu/cfr/text/45/164.512 And then there's the HHS interpretation of the above for providers, which is... porous: https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe... Of particular note are the exemptions in 45 CFR 164.512(k)(2) applicable to powers granted by executive order 12333 (on mass surveillance). When this exemption is used it makes discovering whether, when, how, or why your data was collected or used practically impossible.