Comment by buildsjets | Hacker News Reader

Comment by buildsjets | Hacker News Reader

The P in HIPAA stands for Portability, not Privacy. The primary purpose of HIPAA is not to prevent the sharing of confidential patient data, it is to ENABLE the sharing of confidential patient data with anyone who has the right to see it. The issue is the number of entities who claim that they have right to see the data, and the lack of a mechanism for the individual to prevent their information from being shared.

Should Facebook have a right to access your health data? Your opinion does not matter, they wanted it, and they got it. What about the US Department of Transportation? They maintain the right to access the electronic medical records of any person who falls under their regulation, such as pilots and truck drivers. They have been know to go on fishing expeditions trolling through medical records in search of violations. Search for Operation Safe Pilot. I know several people who have either avoided medical treatment because of this issue, or obtained treatment in a foreign country.

I work in healthcare; these views are my own, and IANAL.

> The P in HIPAA stands for Portability, not Privacy.

… sure, that P stands for that. But one of the key sections is literally called the Privacy Rule: "The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information"

> Should Facebook have a right to access your health data? Your opinion does not matter, they wanted it, and they got it.

No. Wantonly sharing PHI with Facebook would almost certainly be a violation of HIPAA … and literally, it's already happened, this year even[1]: "The office warned that entities covered by HIPAA aren’t allowed to wantonly disclose HIPAA-protected data to vendors or use tracking technology" ("Vendors" here included Facebook and the like.) ¹

Now, HIPAA only applies to covered entities. In the context of the OP however, a hospital is a covered entity. Whether eavesdropping is permissible is a good question.

[1]: https://www.politico.com/news/2023/04/17/health-industry-dat...

¹I think regulatory agencies across the board have been giving pittances for fines, and these are no exception. There's a real question as to whether enforcement is actually meaningful, but that's separate question from whether there is a right.

It's only "key" in the sense that it's the part technologists and people building PHI-encumbered products have to care about. It's not a key section in the bill itself; in fact, I don't even think it's a key part of the section of the bill it's in (which, I think, is about Medicare fraud).

Okay … sure. "Key" if you're like me, and working in healthtech, I suppose, as it's one of the sections they repeatedly try to cram into your head in the mandatory training sessions. (…and for good reason.) In the intersection of Facebook and PHI.

Let's put it this way: something being a key part of a particular solution implementation, does not necessarily imply that it was a key part of the solution's design; nor that it was a key part of the problem domain.

Compare/contrast: there's one ability a Pokemon can have, that just by existing, means that the games' battle-system logic has to be re-entrant, because the ability evaluates a hypothetical battle "within" the current battle in order to determine what it does. Insofar as you're being asked to code the Pokemon battle system, the existence of that ability is very important to you; but it's nevertheless not a key aspect of the game's design — the game would be the same game without it. :)

Y'all are nit picking a single word in my comment whose removal doesn't affect the comment in any way. Key to the point, key in this circumstance, etc.

I understand what you mean. And for technologists, it's more than "key", it's like, the only thing in HIPAA. My point is just, however important that section to us, it's not remotely the point of HIPAA itself; it's not even really the point of the confidentiality rulemaking.

They have been know to go on fishing expeditions trolling through medical records in search of violations. Search for Operation Safe Pilot. I know several people who have either avoided medical treatment because of this issue, or obtained treatment in a foreign country.

I searched for Operation Safe Pilot, and it looks like they matched up aviation medical clearances with social security disability claims, not with general medical records. If you're claiming for a disability, there's something seriously wrong and you shouldn't be flying, or you're lying about the disability and committing social security fraud. Am I missing anything?

Reply on news.ycombinator.com