4 ms·

HIPAA as a law is intended to ease transfer of medical information, not restrict it.

by dekhn 6mo ago

ux266478 6mo ago
That's not true. It's intended to define a regulated and standard means of transferring medical information while ensuring confidentiality and patient privacy. https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... You have to explicitly grant permission for your data to be sold. What's very likely is that either the healthcare provider or insurance company included a request for authorization to sell that data, and the authorization was signed without paying much attention to it.
- dekhn 6mo ago
  You're referring to the privacy rule, which is only part of the law (and not its primary prupose). The original intent of the law was to ensure easy transfer of information to keep health coverage when changing jobs. The privacy rule was not even part of the original law, it was added by HHS 3 years later. See more details here: https://www.ncbi.nlm.nih.gov/books/NBK9576/ https://www.ncbi.nlm.nih.gov/books/NBK9576/
  - arikrahman 6mo ago
    The article you cited states congress was aware of privacy concerns at the time and covered them as part of the third stated provision.
- incr_me 6mo ago
  You wouldn't need such a modern privacy rule if it weren't for the need for information portability in the digital age. The distinction between whether or not portability or privacy is primary in the law kind of doesn't matter. The real purpose of HIPAA was to help make the newly emerging market forms of health care sustainable. Protocol standardization and modernization of the Hippocratic Oath were both necessities, technical and ideological respectively.
SirFatty 6mo ago
"The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US federal law designed to protect sensitive patient health information from disclosure without consent."
- dekhn 6mo ago
  That's not really correct. It was designed for portability- the ability to move data between health care providers. (I work in healthcare-adjacent and have met with many lawyers and had to explain them all about "HIPAA compliance"; my comment was not made from ignorance, but practical experience based on learning about how the law is used. There is a privacy rule in it, but that was not the real intent of the law. The intent was to make it easy to keep your health care when you moved between jobs.)
- nickff 6mo ago
  Could you please cite the source for that quote? I looked for it, but couldn't find a source; it seems like an AI hallucination.
  - nickthegreek 6mo ago
    Why would you call it an hallucination because you cant find immediately locate the source? You didnt say what in the single sentence would make you jump to that conclusion. I highlighted SirFatty's text, looked up on google and first result show it near verbatim on cdc.gov. https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html https://www.cdc.gov/phlp/php/resources/health-insurance-port...
    - dekhn 6mo ago
      Here's the original text of the bill's purpose; very little of the bill talks about privacy, and most of the rules around that are part of the HHS Privacy Rule. To amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.
aksss 6mo ago
Narrator: "But it did neither." Honestly, we're better off with it than without it, speaking as someone with exposure to that industry's internals. That act drives a lot of good security practice within the organizations (mostly liability shifting, but still good). Specifically, the fear it instills of ruinous penalties from regulators drives good practice adoption, IME. Further, multiple crappy patient portals across providers is a crummy experience, but it's an improvement over the world where providers held the data hostage and had zero interest in accommodating your requests for it, or even the idea that you owned it.
ButlerianJihad 6mo ago
The second “P” in HIPAA stands for “Privacy”
- dekhn 6mo ago
  I wonder if that's why so many people write it as HIPPA.
  - tardedmeme 6mo ago
    That's because it's very similar to the name of an animal which is not called a hipoo.

HIPAA as a law is intended to ease transfer of medical information, not restrict it.

by dekhn 6mo ago

HIPAA as a law is intended to ease transfer of medical information, not restrict it.

That's not true. It's intended to define a regulated and standard means of transferring medical information while ensuring confidentiality and patient privacy. https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... You have to explicitly grant permission for your data to be sold. What's very likely is that either the healthcare provider or insurance company included a request for authorization to sell that data, and the authorization was signed without paying much attention to it.

dekhn 6mo ago
You're referring to the privacy rule, which is only part of the law (and not its primary prupose). The original intent of the law was to ensure easy transfer of information to keep health coverage when changing jobs. The privacy rule was not even part of the original law, it was added by HHS 3 years later. See more details here: https://www.ncbi.nlm.nih.gov/books/NBK9576/ https://www.ncbi.nlm.nih.gov/books/NBK9576/
- arikrahman 6mo ago
  The article you cited states congress was aware of privacy concerns at the time and covered them as part of the third stated provision.
incr_me 6mo ago
You wouldn't need such a modern privacy rule if it weren't for the need for information portability in the digital age. The distinction between whether or not portability or privacy is primary in the law kind of doesn't matter. The real purpose of HIPAA was to help make the newly emerging market forms of health care sustainable. Protocol standardization and modernization of the Hippocratic Oath were both necessities, technical and ideological respectively.

SirFatty 6mo ago

"The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US federal law designed to protect sensitive patient health information from disclosure without consent."

dekhn 6mo ago
That's not really correct. It was designed for portability- the ability to move data between health care providers. (I work in healthcare-adjacent and have met with many lawyers and had to explain them all about "HIPAA compliance"; my comment was not made from ignorance, but practical experience based on learning about how the law is used. There is a privacy rule in it, but that was not the real intent of the law. The intent was to make it easy to keep your health care when you moved between jobs.)
nickff 6mo ago
Could you please cite the source for that quote? I looked for it, but couldn't find a source; it seems like an AI hallucination.
- nickthegreek 6mo ago
  Why would you call it an hallucination because you cant find immediately locate the source? You didnt say what in the single sentence would make you jump to that conclusion. I highlighted SirFatty's text, looked up on google and first result show it near verbatim on cdc.gov. https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html https://www.cdc.gov/phlp/php/resources/health-insurance-port...
  - dekhn 6mo ago
    Here's the original text of the bill's purpose; very little of the bill talks about privacy, and most of the rules around that are part of the HHS Privacy Rule. To amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.

aksss 6mo ago

Narrator: "But it did neither." Honestly, we're better off with it than without it, speaking as someone with exposure to that industry's internals. That act drives a lot of good security practice within the organizations (mostly liability shifting, but still good). Specifically, the fear it instills of ruinous penalties from regulators drives good practice adoption, IME. Further, multiple crappy patient portals across providers is a crummy experience, but it's an improvement over the world where providers held the data hostage and had zero interest in accommodating your requests for it, or even the idea that you owned it.

ButlerianJihad 6mo ago

The second “P” in HIPAA stands for “Privacy”

dekhn 6mo ago
I wonder if that's why so many people write it as HIPPA.
- tardedmeme 6mo ago
  That's because it's very similar to the name of an animal which is not called a hipoo.