4 ms·
I'm in Canada so HIPAA doesn't apply for me but when I was going into my second year of university the student union signed a contract with a health insurance c
by Teever 3y ago
I'm in Canada so HIPAA doesn't apply for me but when I was going into my second year of university the student union signed a contract with a health insurance company that provided some piddly policy for students that was mandatory unless you could provide proof of insurance with another company.
Not only was there no way to refuse this but you were automatically enrolled unless you could provide that proof by a certain date.
I got into an argument with the student president about this because I considered it a massive overreach for the school to give my information to the student union who then turns around and gives it to a third party, and that this is just some how a part of completing post secondary education. He was adamant that it was both legal and ethical, and that there was no privacy violation that occurred.
I ended up opting out in time but a few months later I received an email from the insurance company stating that they had been hacked and they weren't quite sure what information had been leaked.
I've never found out what information was transmitted from the student union to the health insurance company, if the company managed to get access to my health records, or if that company has sold those records, or been acquired by a large company that has added those records to their collection, or what the hackers manged to steal.
I guess this is all legal because some student union that gets less than 9% of the student body to vote for them said so?
- Ensorceled 3y ago> I'm in Canada so HIPAA doesn't apply for me But PIPEDA definitely applies to this situation, but PIPEDA only came into effect on April 2020 so it would depend upon when you were a student.
- Scoundreller 3y agoDepends on province, you might be covered under a provincial regulation. PIPEDA takes effect if your province doesn't have a substantially similar law. PIPEDA came into effect in 2000.
- JohnFen 3y ago> He was adamant that it was both legal and ethical, and that there was no privacy violation that occurred. I could understand about it being legal, maybe even ethical (ethical codes can differ) -- but to argue that there is no privacy violation? That just seems completely delusional.
- Scoundreller 3y ago> I've never found out what information was transmitted from the student union to the health insurance company, if the company managed to get access to my health records The insureco initially would only get your basic demographics (name, gender, age, DOB, phone# & maybe address). The student union doesn't have anything else to give. In terms of health info, the insureco would only have what you gave them (indirectly via the pharmacy if you presented a prescription for billing to your health plan). So other than the basic demographics, even if you're forced into the plan, any further info the insureco gets is voluntarily provided by you (but I get that it's a kick in the teeth to pay for insurance, but not use it). > I ended up opting out in time were you already with another insurance company provided by someone's employer? Mine keeps changing providers every few years and I can't opt-out other than resign.