3 ms·

> To preemptively address concerns about HIPAA laws, etc, being adequate protection Broadly speaking, HIPAA does three things: 1. It ensures that you (as a pa

> To preemptively address concerns about HIPAA laws, etc, being adequate protection Broadly speaking, HIPAA does three things: 1. It ensures that you (as a patient) have some rights regarding accessing your own data and records. 2. It requires that entities who collect data on you ("covered entities") go through certain procedures when storing and sharing your data 3. It requires certain procedures if and when data is breached. It does not require covered entities to obtain consent before sharing your data with other companies[0]. It is often necessary to share data with outside entities in order to provide medical care[1]. All it does is mandate a certain legal structure around that sharing of data. In other words, your data is already being transmitted in ways that you likely aren't aware of. (Whether or not you view this as good/bad, necessary/superfluous is a matter of opinion, but there are a lot of misconceptions about what HIPAA actually does for patients). Less known is the more recent HITECH act[2], passed as part of the 2009 stimulus. It provides additional restrictions and regulations, but most of those are around the security of transportation and storage of patient data (and the penalties for noncompliance), not around patient consent. (Obligatory: I am not a lawyer, I am not your lawyer, and this is not legal advice. [0] https://en.wikipedia.org/wiki/Hipaa#Privacy_Rule https://en.wikipedia.org/wiki/Hipaa#Privacy_Rule [1] http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/businessassociates.html http://www.hhs.gov/ocr/privacy/hipaa/understanding/covereden... [2] https://en.wikipedia.org/wiki/Health_Information_Technology_for_Economic_and_Clinical_Health_Act https://en.wikipedia.org/wiki/Health_Information_Technology_...

karmajunkie 12y ago
While technically correct, I think you're glossing over the "legal structure around sharing" bit. In order to share data, there has to be a Business Associates Agreement in place (commonly referred to as a BAA for readers not in the industry.) one of the things that HITECH did was mandate that BA's are ALSO liable for data breaches in the same way covered entities are (provided data is breaches in their custody, of course). This means a BA has to maintain all of the same training and compliance requirements, including physical and logical security and auditing requirements.
- chimeracoder 12y ago
  > BA's are ALSO liable for data breaches in the same way covered entities are (provided data is breaches in their custody, of course). This means a BA has to maintain all of the same training and compliance requirements, including physical and logical security and auditing requirements. Yes, but none of that matters if your concern is limiting who actually has (legal) access to your data, which I believe was the original concern. Business associates may be liable for data breaches, but OP's concern seems to include the fact that the covered entities don't even have to receive consent from the patient before sending data to the business associate in the first place ("In summary, you can no longer assume confidentially between health providers/monitors and patient interactions, to the detriment of all involved.").

karmajunkie 12y ago

While technically correct, I think you're glossing over the "legal structure around sharing" bit. In order to share data, there has to be a Business Associates Agreement in place (commonly referred to as a BAA for readers not in the industry.) one of the things that HITECH did was mandate that BA's are ALSO liable for data breaches in the same way covered entities are (provided data is breaches in their custody, of course). This means a BA has to maintain all of the same training and compliance requirements, including physical and logical security and auditing requirements.

chimeracoder 12y ago
> BA's are ALSO liable for data breaches in the same way covered entities are (provided data is breaches in their custody, of course). This means a BA has to maintain all of the same training and compliance requirements, including physical and logical security and auditing requirements. Yes, but none of that matters if your concern is limiting who actually has (legal) access to your data, which I believe was the original concern. Business associates may be liable for data breaches, but OP's concern seems to include the fact that the covered entities don't even have to receive consent from the patient before sending data to the business associate in the first place ("In summary, you can no longer assume confidentially between health providers/monitors and patient interactions, to the detriment of all involved.").