Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why do shared hospital rooms not violate HIPAA?

law.stackexchange.com

Post reply on HN
Print view View original

111–120 of 150 posts

Re: Why do shared hospital rooms not violate HIPAA?

#111

Post by ghaff »

jasonhong wrote: post #102
bombcar wrote: post #92

Earlier quoted context omitted.

And medical issues are such that even fully anonymous you can probably identify who is whom.

Latanya Sweeney demonstrated how hard it is to anonymize health data back in the late 1990s as part of her dissertation work: https://arstechnica.com/tech-policy/2009/09/your-secrets-liv... "At the time GIC released the data, William Weld, then Governor of Massachusetts, assured the public that GIC had protected patient privacy by deleting identifiers. In response, then-graduate student Sweeney started hunting for th…

Yep. I've used that example in presentations. If you really want to de-anonymize a medical record, it's pretty easy to do so on the basis of other data which is arguably public for good reasons (and/or as a matter of law).

Re: Why do shared hospital rooms not violate HIPAA?

#112

Post by nonameiguess »

swayvil wrote: post #41
tekla wrote: post #32

Earlier quoted context omitted.

An overnight stay is for observation not comfort. The hospital wants to gather as many metrics as possible to keep you alive, respond ASAP to issues and dis-chargable to free up room for other sick patients. not give you a hotel bed.

Go to the hospital healthy, come out sick. I don't have a medical degree or anything but that's crazy. (Also, the nurse said nobody sleeps here. Not just the people under observation.)

Why are you staying overnight in a hospital if you're healthy? The few times I've stayed overnight in a hospital, it was for surgical recovery and I definitely slept. I was on so many painkillers, I barely remember the experience. My wife did a four-day stint in the ICU when her liver failed years back, and from what I remember, she was barely conscious the first few days. I don't know if I'd call either of those experiences comfortable, but she's alive and I now have a working spine, and neither of those would have been true otherwise. So thanks hospitals.

Re: Why do shared hospital rooms not violate HIPAA?

#113

Post by anderiv »

NoZebra120vClip wrote: post #103
supertrope wrote: post #46

Earlier quoted context omitted.

Clinics that deal with the most sensitive medical needs tend to be more careful. HIV testing, reproductive health, psychiatry, hospice.

[flagged]

This was not a productive, nor necessary comment. Please retract it and take it elsewhere. It has no place on HN.

Re: Why do shared hospital rooms not violate HIPAA?

#114

Post by mr_toad »

dclowd9901 wrote: post #87
tptacek wrote: post #53

It's easier to make sense of when you remember the original purpose of HIPAA, which was cost control and portability (that's what the 'p' stands for!). The confidentiality rules in HIPAA are part of (IIRC, I think, etc?) the "Administrative Simplification" section, which was about standardizing electronic health care records and making them available to the government for combating Medicare fraud. The law wasn't a sw…

Which sucks because there is tremendous value in anonymized collections of health records, yet we can’t use these health records for research at all. I realize it was out of scope for the bill, but damned if it didn’t stymie medical research to a ridiculous degree.

Anonymised collections of health records are available to bona fide researchers.

Re: Why do shared hospital rooms not violate HIPAA?

#115

Post by voicedYoda »

One of the interesting rules of HIPAA is that if it starts analog, it doesn't have to conform to encryption technologies, i.e. phone calls and fax machines don't require the complexities a digital system, like an electronic medical record, require.

When HIPAA was created, a large impetus was getting large health systems onto electronic records. Portability and accountability reigned high. And there's a lot of information and misinformation about this.

Attorney general letters help clarify a lot of it.

But sharing a hospital room doesn't violate anything related to HIPAA because that isn't what the law protects.

Re: Why do shared hospital rooms not violate HIPAA?

#116

Post by jliptzin »

DoreenMichele wrote: post #58
jliptzin wrote: post #20

Earlier quoted context omitted.

I once went to the dermatologist, the doctor left the room briefly and had the computer screen open with everyone’s full name and reason for the visit that day…could see who was there for genital warts, Botox, etc. I don’t think anyone should expect that their health info remains private at any point

What your doctor did is actually a HIPAA violation. He's a covered entity and securing computer screens is a standard precaution for such. In reality, a lot of doctor's offices are not well versed in HIPAA because many are de facto small businesses. Large hospitals and insurance companies generally have better knowledge of HIPAA and HIPAA compliance.

I just wish we would all stop pretending that everyone's medical info is protected when it clearly isn't...so now we have the worst of both worlds. All the red tape of HIPAA compliance with no actual privacy anyway. And it's plenty of red tape. I have to now find a FAX machine to send test results to a doctor, because according to him that's the only HIPAA compliant method that he accepts, but the sending doctor doesn't have a fax machine.

Re: Why do shared hospital rooms not violate HIPAA?

#118

Post by ghaff »

mr_toad wrote: post #114
dclowd9901 wrote: post #87

Earlier quoted context omitted.

Which sucks because there is tremendous value in anonymized collections of health records, yet we can’t use these health records for research at all. I realize it was out of scope for the bill, but damned if it didn’t stymie medical research to a ridiculous degree.

Anonymised collections of health records are available to bona fide researchers.

The point is that "anonymized" data is frequently relatively straightforward to de-anomymize at least on a statistical basis.

Re: Why do shared hospital rooms not violate HIPAA?

#119

Post by ern »

buildsjets wrote: post #31

The P in HIPAA stands for Portability, not Privacy. The primary purpose of HIPAA is not to prevent the sharing of confidential patient data, it is to ENABLE the sharing of confidential patient data with anyone who has the right to see it. The issue is the number of entities who claim that they have right to see the data, and the lack of a mechanism for the individual to prevent their information from being shared. Sh…

They have been know to go on fishing expeditions trolling through medical records in search of violations. Search for Operation Safe Pilot. I know several people who have either avoided medical treatment because of this issue, or obtained treatment in a foreign country.

I searched for Operation Safe Pilot, and it looks like they matched up aviation medical clearances with social security disability claims, not with general medical records. If you're claiming for a disability, there's something seriously wrong and you shouldn't be flying, or you're lying about the disability and committing social security fraud. Am I missing anything?

Re: Why do shared hospital rooms not violate HIPAA?

#120

Post by DoreenMichele »

jliptzin wrote: post #116
DoreenMichele wrote: post #58

Earlier quoted context omitted.

What your doctor did is actually a HIPAA violation. He's a covered entity and securing computer screens is a standard precaution for such. In reality, a lot of doctor's offices are not well versed in HIPAA because many are de facto small businesses. Large hospitals and insurance companies generally have better knowledge of HIPAA and HIPAA compliance.

I just wish we would all stop pretending that everyone's medical info is protected when it clearly isn't...so now we have the worst of both worlds. All the red tape of HIPAA compliance with no actual privacy anyway. And it's plenty of red tape. I have to now find a FAX machine to send test results to a doctor, because according to him that's the only HIPAA compliant method that he accepts, but the sending doctor does…

When I was in my teens, I chose to go on birth control pills when I became sexually active. Years later, I learned that the pharmacist was a friend of my mother's and told my mother I was on the pill.

Fortunately, my mother bit her tongue and said nothing to me until years later and just was glad I was not being stupid and would not end up pregnant out of wedlock. It could have gone really bad places for me if my mother were inclined to be abusive about it.

These days, a pharmacist is more likely to think twice before sharing that kind of info because it's illegal to do so and it could come back to bite them big time.

HIPAA also helps protect people from discrimination who have medical issues like STDs -- which aren't always sexually transmitted or may be transmitted because someone was assaulted, but some people will just be judgy and not give you the benefit of the doubt and it's a nightmare to have to defend your virtue and tell random strangers "I'm not a whore. I don't sleep around casually. I was raped at gun point." or some such.

Sorry it's such a pain in the ass for you. It's something that helps prevent casually ruinous oversharing for some people.

Post reply on HN