medicareservices.us © All Rights Reserved.  Privacy Policy | Terms of Use

 Real Recent HIPAA Violations

I make a case against a HIPAA loophole. HIPAA was intended to protect people from others who preyed on the misuse of personal health information. Like those with diseases that everyone knew about what they had. That sounds reasonable enough a reason to make the law except that lawmakers and advocates underestimated its unintended consequences of shaping human behavior. In plain English, there is no protection from all the forces that lay wait. As the avatar shows there are many casts of characters in health care. Some that leak information; they can be found in many circumstances. Those that hide behind HIPAA protection; they aren’t as easy to find. For obvious reasons this last group hides behind HIPAA simply because they don’t want others to know about what their practices are. So on this page we begin our discussion with the last group and move on from there.

That sounds reasonable enough to make the HIPAA law except that lawmakers and advocates underestimated its unintended consequences of shaping human behavior.

For those that might be students of historical events there have been many instances before and after the 1960’s where people have pled the 5th Amendment. President Nixon’s henchmen were perhaps the most rebuked to hide behind executive privilege. HIPAA gave protection to health care industry individuals and organizations a similar executive privilege.

Any practitioner in the mental health sector can claim HIPAA protects them from releasing treatment details if their records are called for. It may seem in many of these situations that the identity of the patient or their illness is at stake. If I told you that its not so then what would you think of me? At the same time as it protects the patient it also protects the practitioner from the visibility of their practices and competency at the same time.

The next set of questions would be how important is access? Truth is if access is important then more access = more risk of disclosure. Unless the access is totally shielded from view as information passes thru the system while only exclusive parties receive the information. I suspect the government would make a case that it only can regulate such sensitive information (due to their high moral standards) and the rest of us can’t. So the government can only punish violators. Only the government being the operative term.

Somewhere along the line a nongovernmental mere mortal will need to have access the record and perform medical procedures. Someone will then know and any secrets will then be disclosed. It will be up to the health care professional to be attentive to good and bad medical practices. Is it a HIPAA violation to point them out? To whom? The patient too? Or just to correct them?

Then there are those outpatient independent psychotherapists who are asked to disclose patient records by other psychotherapists and refuse total disclosure to avoid scrutiny. Now we’re back where we began. My conclusion is that HIPAA may most likely empower institutions, the government, but not always empower patients to receive more transparency and assurance of quality care. Then why all the investment in resources to tighten security? Whom are we protecting?

However, the “almost everyone”

standard would be both necessary and sufficient for intervention only if we could count on government to do the right thing well (and only the right thing). But there are reasons why that may not be a reasonable expectation. I will deal with three of these. (There are more.)

1. The common requirement to certify individuals, organizations,and entities as in conformance with the regulations can impose substantial administrative costs on the certifiers and the certified.

2. The existence of rules and regulations often calls forth its counterpart: rent-seeking behavior engendered by the rules, usually(though not always) via the legal system. If there are rules, then the threat to bring someone to court for violations of those rules, the extension of the rules to other similar behavior which might fall under them, and the need to check the coordination of federal rules with other state or local rules all provide fertile ground for resources to be deployed.

3. Finally, regulations that do an imperfect job of defining behavior are, at a minimum, confusing, and at worst may lead to a degradation of behavior down to the minimum standard required by law. Just as there must be far too many inefficient meetings at Grand Central Station because it serves as a fixed point, a poorly drafted or incomplete regulation may play the same role.From: REGULATION OF BAD THINGS THAT ALMOST NEVER HAPPEN BUT COULD: HIPAA AND THE INDIVIDUAL INSURANCE MARKET Mark V. Pauly