3 ms·

What does HIPAA compliance in that setup mean? That any physician can discuss your disease with someone else? I am not a deep expert in HIPAA but I can hardly b

by chopin 13y ago

What does HIPAA compliance in that setup mean? That any physician can discuss your disease with someone else? I am not a deep expert in HIPAA but I can hardly believe that this would be compliant, even if the name of the patient isn't disclosed. I would be pretty upset if my physician discusses my diseases using Google.

nyarlathotep 13y ago
I think the HIPAA comment is likely referring to users being able to talk to healthcare professionals. I very much doubt that line was talking about surgeons, etc. asking for advice.
ubernostrum 13y ago
(once upon a time I worked at a company that did health claim processing, so I had the standard course of HIPAA training, though this was about ten years ago) I think you may be overestimating what the HIPAA privacy rule does. First of all, there are some automatic exceptions to the privacy rule, which allow information to be disclosed without requiring the patient's authorization. One is an exception for law enforcement; we would occasionally get LEOs contacting us, and we had people to forward that to, who would make sure that they came with valid warrants/court orders/etc. to get the information. The other is the broad "TPO" exception: that's Treatment, Payment and Operations. Which means your doctor can share information with other medical personnel, for example, and disclose details to your insurance company, and so on. Finally, anyone else can get access so long as the patient has provided a written authorization to allow it. And generally anyone who's smart is going to get that authorization up-front. HIPAA also defines the scope of "Protected Health Information", which is essentially individually-identifiable information relating to a person's past/present/future health, health care they have received/are receiving/will receive, and related payment information. Now, I don't know offhand what exactly Google intends this service to do, or what steps they've taken to achieve compliance, but I don't see it as being particularly difficult to achieve. I would be pretty upset if my physician discusses my diseases using Google. Your physician likely already uses the internet, the telephone system and regular old snail mail to transmit/discuss information about patients, including you. Do you trust any of those more than you trust Google?

by chopin 13y ago

nyarlathotep 13y ago

I think the HIPAA comment is likely referring to users being able to talk to healthcare professionals. I very much doubt that line was talking about surgeons, etc. asking for advice.

ubernostrum 13y ago

(once upon a time I worked at a company that did health claim processing, so I had the standard course of HIPAA training, though this was about ten years ago) I think you may be overestimating what the HIPAA privacy rule does. First of all, there are some automatic exceptions to the privacy rule, which allow information to be disclosed without requiring the patient's authorization. One is an exception for law enforcement; we would occasionally get LEOs contacting us, and we had people to forward that to, who would make sure that they came with valid warrants/court orders/etc. to get the information. The other is the broad "TPO" exception: that's Treatment, Payment and Operations. Which means your doctor can share information with other medical personnel, for example, and disclose details to your insurance company, and so on. Finally, anyone else can get access so long as the patient has provided a written authorization to allow it. And generally anyone who's smart is going to get that authorization up-front. HIPAA also defines the scope of "Protected Health Information", which is essentially individually-identifiable information relating to a person's past/present/future health, health care they have received/are receiving/will receive, and related payment information. Now, I don't know offhand what exactly Google intends this service to do, or what steps they've taken to achieve compliance, but I don't see it as being particularly difficult to achieve. I would be pretty upset if my physician discusses my diseases using Google. Your physician likely already uses the internet, the telephone system and regular old snail mail to transmit/discuss information about patients, including you. Do you trust any of those more than you trust Google?