I don't even think a HIPAA-covered entity could hold their data to the standard of zero-knowledge encryption... since, you know, they have to be able to use patient data.
in theory they could but I doubt most patients want to have to remotely authorize their provider any time someone wants to access their record.
They could authorize an agent to authorize provider usage. The agent could apply provider-specific policies, and potentially monitor record requests to try to identify fraud, waste, or abuse, and so forth. The patient regularly reviews a report of actions taken by the agent to adjust configuration or revoke authorization. Could be an interesting approach!
All of the access audit information exists, afaik, albeit in non-standardized form. Because the law distinguishes between wilful and inadvertent releases, and assesses penalties on the basis of count and type, covered entities darn well better be able to produce an audit trail when asked.
It also needs to be a system that is workable when you scrape an unconscious person off the street with no next-of-kin available. It's not possible to have the patient or their agent hold the sole key for data that is created before the patient/agent is first available. Really, the best you can do in that situation is exactly what HIPAA requires.
Good point, implied consent does make such a system unworkable.
Agent should not be individual it should be an third party service or organization( could even by governmental) which shouldn't have uptime concerns. The policy setup would be complex to do without expert assistance anyway.
Maybe so, but that's a different thing than the zero-knowledge encryption that this branch of the comment thread was originally about.
Agent only handles the policy and access, they don't have access to the data itself It is still zero knowledge ?
In a healthcare context, the patient often may not physically be able to.