I'm the founder of a health-tech startup, so HIPAA is something I spend a lot of time thinking about. (Disclaimer: IANAL) > A lot of the medical data about yo

I'm the founder of a health-tech startup, so HIPAA is something I spend a lot of time thinking about. (Disclaimer: IANAL) > A lot of the medical data about you is essentially the doctor's or industry's data, not yours. It can be difficult to impossible to get everything about you disclosed to you; it is for all intents and purposes data about you but not owned by you. Quite the opposite - a large portion of HIPAA is about the rights of the patient to access their medical data. Actually going through this formal process has a number of steps, but some of the first lawsuits regarding HIPAA were actually about this, not about the safeguards on sharing or security. In fact, under HIPAA, doctors and insurance companies are allowed to share your data with other entities ('associates') without consulting you first, as long as they sign another agreement with that entity promising that they'll abide by certain rules. Those associates are allowed to share it with other associates, and so on, etc. - all of it is legal as long as there's a trail of these agreements going all the way back to the doctor, hospital, or insurance company. Anytime that you sign a document authorizing release of your information to a third party, that's generally referring to releasing data that they can't legally share under HIPAA via the above means. There are some caveats, but this is more or less what is already happening to your medical data - you just don't know about it.