Earlier quoted context omitted.
Wow, that's a gaping privacy loophole.
The P in HIPAA stands for "Portability," not "Privacy."
Sure, but privacy has been a design consideration of HIPAA since 2003.
Pharmacies share medical data with police without a warrant, inquiry finds
41–47 of 47 posts
Re: Pharmacies share medical data with police without a warrant, inquiry finds
#42Earlier quoted context omitted.
> This is actually a pretty good use of the data if its done by a university for a study or the NIH in a nonprofit capacity. As long as everyone who's data is used has consented to it, then yes.
Does HIPPA apply if its a large study and each is anonymonized? I'm assuming insurance companies already use the data so the 20 page EULA already has consent.
Don't know. I'm not talking about legalities, I'm talking about ethics. I'm talking about getting actual consent, not the fake "consent" that tends to get snuck into contracts.
Re: Pharmacies share medical data with police without a warrant, inquiry finds
#43This sort of thing underscores how impossible it is to stay safe in our society. If you can't even get medical care without your data being mined for all it's worth, what can you do? So utterly depressing.
We can start by not voting for the usual suspects because the usual suspects mean the usual routine. Telling ourselves that "these usual suspects" are slightly better than "those usual suspects" is a poor trade. It garantees the usual routine. There is more of course, such as insisting on the more private path when there is an option. Because often there is an option. Just not always. Also this one is actually very e…
> So there you go: CVS, Kroger, Rite Aid are clearly sending us to their competitors. In most places, it's easy to shift prescriptions to a competitor.
Where I am, every pharmacy is one of those three. There are no competitors to shift to.
Re: Pharmacies share medical data with police without a warrant, inquiry finds
#44Earlier quoted context omitted.
We can start by not voting for the usual suspects because the usual suspects mean the usual routine. Telling ourselves that "these usual suspects" are slightly better than "those usual suspects" is a poor trade. It garantees the usual routine. There is more of course, such as insisting on the more private path when there is an option. Because often there is an option. Just not always. Also this one is actually very e…
> So there you go: CVS, Kroger, Rite Aid are clearly sending us to their competitors. In most places, it's easy to shift prescriptions to a competitor. Where I am, every pharmacy is one of those three. There are no competitors to shift to.
Well, then YOU are stuck (although Amazon mail order might help you). The rest of us will avoid these 3. That's fine.
It's about adding pressure - since no matter what no pharmacy will be completely immune to a cop "leaning over the counter". And pharmacies are only a small part of the problem.
Re: Pharmacies share medical data with police without a warrant, inquiry finds
#45Earlier quoted context omitted.
Does HIPPA apply if its a large study and each is anonymonized? I'm assuming insurance companies already use the data so the 20 page EULA already has consent.
Don't know. I'm not talking about legalities, I'm talking about ethics. I'm talking about getting actual consent, not the fake "consent" that tends to get snuck into contracts.
It's funny we are talking about this since yesterday i went to a new doctor and they used my prescription history that they already have access to im guessing in the same software they used to prescribe to ask me about the medications i am taking instead of taking my word for it on the form i filled out.
Re: Pharmacies share medical data with police without a warrant, inquiry finds
#46Anyone remembers the video rental privacy law? In the US we basically for some reason must have a specific law about each specific modality. For those who don't remember, it was explicitely illegal for video stores to disclose rental records (still is). And of course, you guessed it, this law happened because a politician had their rental records disclosed (a judge in this case) https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act
Apparently some digital video lawyers are trying to use it there.
And I don't know how well it blocked disclosures when cops asked.
Librarians at (good) public libraries are used to refusing disclosure.
But no, not pharmacies.
Re: Pharmacies share medical data with police without a warrant, inquiry finds
#47Earlier quoted context omitted.
Wouldn’t this be a massive HIPAA violation??
When you buy health insurance, you sign a temporary HIPAA release (limited duration) to cover the period that they are underwriting. They can only query your specific pharmacy records for the purposes of underwriting. So yes, this is a HIPAA violation when it is being used by the police. I work in this space with HIPAA data.
> So yes, this is a HIPAA violation when it is being used by the police. I work in this space with HIPAA data.
It is not, because HIPAA includes an "official/governmental purposes" exemption. See exemption (5)
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...
> Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).29
> Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.33
> Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34
> Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.41