Hacker News Reader

Comment by fardo | Hacker News Reader

The second comment feels closer to the mark. While post-hoc justifications could be made as to why a rule at least in spirit seemingly about patient privacy ignores an obvious and glaring privacy flaw, if the parties involved could be so honest, the real-world answer why it’s allowed would probably be

> “It would be extraordinarily inconvenient and expensive for it to work otherwise.”

Sprinkle on a little bureaucrat-ese and post-hoc justification and you get the “clarified guidance” the primary comment calls out

View on HN

It's about the confidentiality of electronic medical records, not about patient privacy.

If we’re discussing

> What is the motivation behind keeping medical records confidential, why do we actually care?

A respect for the patient’s privacy is likely going to be one of the driving reasons, if not the primary reason itself.

No, that's not the actual reason! The reason the rule exists is because, when HIPAA was passed, electronic patient health records were a new thing, and they were desired both for cost savings (electronic records as a way to drive administration costs down were a huge thing in the 1990s) and so the USG could combat Medicare fraud. The confidentiality rule was designed to ease the acceptance of electronic records; that's all. That's why the rule refers to e-PHI.

You’re correct regarding historical procedure, but with regards to the privacy rule, which was added shortly after its creation and at least online is much of why the act is known and discussed today, the rule exists to, quoting the government’s description,

> The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization.

We allow a major hole here in that protected health information by willfully careful readings of “appropriate safeguards” and “limits and conditions”, essentially because doing otherwise would be a nightmarish expense and pain.

HHS was authorized by statute to make a specific set of rules to address a specific issue. When we refer to "The Rule", we're referring to HHS's rulemaking process, which is governed by the statute, which spells out what the rule is about.

Reply on news.ycombinator.com