81–90 of 150 posts
The second comment feels closer to the mark. While post-hoc justifications could be made as to why a rule at least in spirit seemingly about patient privacy ignores an obvious and glaring privacy flaw, if the parties involved could be so honest, the real-world answer why it’s allowed would probably be > “It would be extraordinarily inconvenient and expensive for it to work otherwise.” Sprinkle on a little bureaucrat-…
From the HHS.gov website: The Privacy Rule permits certain incidental uses and disclosures that occur as a by-product of another permissible or required use or disclosure, as long as the covered entity has applied reasonable safeguards and implemented the minimum necessary standard, where applicable, with respect to the primary use or disclosure. See 45 CFR 164.502(a)(1)(iii). An incidental use or disclosure is a sec…
One idea my nefarious side had was to get the med records of individuals and get the address's house cost, and send scary calls/text/messages shaking relatives down with scare-calls. (Or, get the info and get in league with overseas scammers who masquerade as the hospital, and take a cut from that. Would be relatively risky free.)
Obviously I wouldn't do that. But it would be trivial to do.
(Long story short, pager infrastructure needs destroyed.)
The top comment here is very reasonable, but I still think the application of HIPAA has been a giant mess, reflecting a disdain toward patients similar to everything else in the US healthcare system. I've ranted on here plenty about how often I've dealt with incorrect bills, and HIPAA plays into that as well. My private information can be shared to "traveling doctors", it can be shared with woefully incompetent contr…
That's actually a great reason to refrain from discussing someone else's medical data with you. That it is inconvenient for you is certainly bad, but that is a non sequitur.
> It doesn't seem to me that HIPAA actually does much to protect my privacy, but it sure gets used to obfuscate things when there's a problem.
If we allowed Bill Handler, Inc. try their hand at securely implementing "for the purposes of this call, pretend I'm someone else," you're going to have TWO_PROBLEMS * NO_OF_DEPENDENTS
Earlier quoted context omitted.
If we’re discussing > What is the motivation behind keeping medical records confidential, why do we actually care? A respect for the patient’s privacy is likely going to be one of the driving reasons, if not the primary reason itself.
No, that's not the actual reason! The reason the rule exists is because, when HIPAA was passed, electronic patient health records were a new thing, and they were desired both for cost savings (electronic records as a way to drive administration costs down were a huge thing in the 1990s) and so the USG could combat Medicare fraud. The confidentiality rule was designed to ease the acceptance of electronic records; that…
> The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization.
We allow a major hole here in that protected health information by willfully careful readings of “appropriate safeguards” and “limits and conditions”, essentially because doing otherwise would be a nightmarish expense and pain.
How does HIPAA compare to FERPA? My understanding is that FERPA is similar to HIPAA, except for college scores and enrollment information instead of medical records. But there’s a rule in FERPA where you explicitly can’t leave a stack of exams and let students pick them, because it exposes students to others’ scores. Another rule is that you can’t associate a students exam with their student ID even if it’s a sequenc…
In my college people definitely remembered other people's IDs, since all you needed to badge into any door they had access to was to write their ID and a 00+(number of replacement badges) to the data track on a swipe card. This gave access to even dorms. This even worked for faculty or Deans who had full access to all academic and athletic facilities.
Clearly nobody would ever know anybody else's public ID, because that would take just going into a study session and looking at the sign in sheet of hundreds of them sitting in the back of the classroom. Or looking at the log of swipes of an event that a dean attended.
It's easier to make sense of when you remember the original purpose of HIPAA, which was cost control and portability (that's what the 'p' stands for!). The confidentiality rules in HIPAA are part of (IIRC, I think, etc?) the "Administrative Simplification" section, which was about standardizing electronic health care records and making them available to the government for combating Medicare fraud. The law wasn't a sw…
The top comment here is very reasonable, but I still think the application of HIPAA has been a giant mess, reflecting a disdain toward patients similar to everything else in the US healthcare system. I've ranted on here plenty about how often I've dealt with incorrect bills, and HIPAA plays into that as well. My private information can be shared to "traveling doctors", it can be shared with woefully incompetent contr…
Agreed, the individual records are not specifically secret. The regulations are to prevent unauthorized disclosure and misuse. Unfortunatly that leaves a lot of leeway. The major EMR vendors are all aggregating patient data in cloud services and taking it across borders to where there is no transparency for what is being done with it. The regulations were written with a 90's understanding of technology. A more approp…
Earlier quoted context omitted.
It's only "key" in the sense that it's the part technologists and people building PHI-encumbered products have to care about. It's not a key section in the bill itself; in fact, I don't even think it's a key part of the section of the bill it's in (which, I think, is about Medicare fraud).
Okay … sure. "Key" if you're like me, and working in healthtech, I suppose, as it's one of the sections they repeatedly try to cram into your head in the mandatory training sessions. (…and for good reason.) In the intersection of Facebook and PHI.
Compare/contrast: there's one ability a Pokemon can have, that just by existing, means that the games' battle-system logic has to be re-entrant, because the ability evaluates a hypothetical battle "within" the current battle in order to determine what it does. Insofar as you're being asked to code the Pokemon battle system, the existence of that ability is very important to you; but it's nevertheless not a key aspect of the game's design — the game would be the same game without it. :)
It's easier to make sense of when you remember the original purpose of HIPAA, which was cost control and portability (that's what the 'p' stands for!). The confidentiality rules in HIPAA are part of (IIRC, I think, etc?) the "Administrative Simplification" section, which was about standardizing electronic health care records and making them available to the government for combating Medicare fraud. The law wasn't a sw…
Which sucks because there is tremendous value in anonymized collections of health records, yet we can’t use these health records for research at all. I realize it was out of scope for the bill, but damned if it didn’t stymie medical research to a ridiculous degree.
That said I do think agencies like NIST should define anonymization standards.