Slashdot Mirror
US Approves New Guidelines For Medical Privacy
iElucidate writes: "Mindwire.org is reporting on the adoption by the US Department of Health and Human Services of guidelines for privacy of personal medical records. In 1996 Congress mandated the creation of medical privacy standards by the end of 1999. Since Congress did not act, responsibility went to the Department of Health, which drafted a standard, gave a year for public comment, and finally approved it for use. The new standard requires that hospitals and HMOs keep information secure, and requires stiff penalties for the release of unauthorized information. Finally, no more employers snooping on employees psych. records. About bloody time!" The Department of Health and Human Services issued a fact sheet summarizing the new regulations.
The earlier HIPAA regulations (some 150 pages worth) contained complicated, waffling rules about when the police could get access to health-related information and when it could be released to a court in a legal case. I would like to see what the new regulations say in these areas.
These regulations really do nothing to protect your privacy.
Most of the time your medical information is sent unencrypted across computer networks using well known protocols such as HL7.
Nearly anyone with a packet sniffer at a major university with a medical center can watch patient data flow past.
These regs are just feel good things and do not change anything.
-- Never make a general statement.
Personally, I think we ought to force social conservatives to wear ID tags so that they might be spat upon at will by HIV-infected junkies with paranoid psychoses.
Eloi are stupid, throw morlocks at them!
Maybe you should all restrict your care to organizations that cliam HIPAA compliance?
Any sufficiently well-organized Government is indistinguishable from bullshit.
You just highlighted the biggest reason that "privacy" is an over-rated fanaticism on the internet. Of course your location should be public knowledge--anyone who cares to should be able to track you down, unless you take cares to hide yourself. For a moment, take "privacy" to the physical world--you meet someone, but refuse to let them see your face because it violates your "privacy."
Of course, you should definitly have the option of being prviate--you can hide your face, or close the blinds on your house.
Getting back on topic, this (medical privacy) is a Very Good Thing. When you go to a doctor you're not in public, you're expecting privacy--just like in your marriage bed, or when you go to talk to an attourney about that odd smell in your basement and those weird, violent nightmares...
The problem is that very few organizations are really ready. While hospitals are probably the most ready, it's only the ones with a top-notch IT staff that think they'll make it. As for your local general practitioner's office: Forget It. These people have little idea the law was passed, much less that it's going into effect. If I had the background in CS/Security, I would seriously think about starting a company to *specialize* in HIPPA regulations. The public health industry will pay big bucks to make sure they don't run afoul of these laws....
Examples:
Now, the good news is that these laws won't fully go into effect for a few months, and it's very hard to see right now what priority the incoming Bush Jr. Administration will put on these regulations....sig not found
This is going to be really tricky.
HIPAA started out as administrative simplification and paperwork reduction which is why it is called the "Health Insurance Portability and Accountability Act". Prime focus was on standardizing health insurance paperwork claims to reduce costs.
Obviously, you have to put into place minimal security and privacy rules into these standards, especially since medical centers are notoriously bad at this kind of stuff. But, you also need to keep in place a "back door" for emergency access. If a new patient comes in off the street (unconscious) with urgent need, medical professionals need access to his/her private data to provide appropriate care.
Your point is well taken, I just hope people reolise that the ADA has been dismantled by the court and is no longer an effective protection. This law by the clinton adminastration is a start, but more needs to be done. -Daniel
Ownyourphone.com. Custom ringtones, cheap and easy
HIPPA will require all EDI transactions to be encrypted, first over the Internet, and later even LAN traffic must be encrypted.
At IDX Systems we're using PGP to send claims transactions to clearing houses.
-An EDI drone
Fight Spammers!
Last semester, my school started providing insurance for us grad research assistants... I decided to look at the insurance company web site ( http://www.gmsouthwest.com/eligibility/ )... Gee, it looks swell. It doesn't even say you can't look at other peoples' records, all you need is their social security number and their last name. I suppose it was a nice gesture, the school providing health insurance, but I don't think I'll be using it.
It seems that every time the government issues these sorts of regs, it expands the amonunt of information it gets, at the expense of the amount of information available in the public sector.
668: Neighbour of the Beast
Why should everyone be entitled to medical privacy?
There are surely conditions under which the government, and indeed neighbours, deserve to know whether a person has particular medical conditions.
For a start, mental illness. It is important to know if someone you have to work in close proximity to has a serious mental condition, and could conceivably be a danger to others. Or how about AIDS? Considering how dangerous this disease is (we are always being told this), shouldn't the government introduce mandatory testing, and even quarantine?
Just a few ideas.
Now, the real question is, how in the world did these companies aquire the right to information that is supposed to be between you and the government, and nobody else?
Also consider the telephone company, which operates by similar policies of "to hell with customer privacy, we're making money". Witness the following scenario: I move to a new apartment. I set up my new phone service. By default, my name, address, and phone number are pimped out to whoever has the money to buy them, aka the phone book. It's the same idea as the ID scanning. What in the world gives these people the right to our personal information? Of course the answer is the US government. They probably encourage this behavior, since it only adds to their ability to "protect us from ourselves".
Sorry for the rant, but this really makes me want to puke.
Government access to medical records for the public good, such as for research, public health crises, and law enforcement.
Limits on HMO and health providers use of and access to health information.
So big brother sees all, but medical companies whose business is health care lose rights to information? Sounds like this could open the door for the insurance lobby. It creates an excuse for health insurance rates to rise - since the company can't know your own particular circumstances, it has to place you into a category of people. Much like the car insurance effect on unmarried males under age 25. Unreal. We have more information and use less of it.
Although it may be illegal by the ADA, I know of people who were not hired because of health info, and I know another who was denied a mortgage because of a heart ailment.
May this help others in like case.
Next up: Federal Medical ID's. We're on our way to socialized medicine...
Icebox
About half way down in the fact sheet...
ESTABLISH ACCOUNTABILITY FOR MEDICAL RECORDS USE AND RELEASE
Penalties for covered entities that misuse personal health information are provided in HIPAA.
Civil penalties. Health plans, providers and clearinghouses that violate these standards would be subject to civil liability. Civil money penalties are $100 per incident, up to $25,000 per person, per year, per standard.
While I don't think those penalties are stiff enough, they do exist.
"Government access to medical records for the public good, such as for research, public health crises, and law enforcement." is a new requirement.
What is that? This means that in any case in which the government sees need, medical records can be used without permission, without compensation, and without guarantees of privacy? Give me a break.
That's what's called a loophole, folks.
Any sufficiently well-organized Government is indistinguishable from bullshit.
I work for a health care company. This law also goes into standardisation of medical, and electronic forms, which is something that is needed. It also forces companies that see your medical information (ie.,the Drs' billing service, the billing services claims clearing house, the insurance company, blah blah blah.) The fact is when you go to most Dr.s, and you have insuracnce then the claim is ether sent via mail, or if your Dr. quit living in the 1800's then it will be transfered electronicly. Remember each of these stops on the way of the insurance comany provides another file to be stored on a server somewhere with all of your medical records. I'm glad that we have this law now, becuase it's forces unethical or ignorant middle man companys to protect your privacy.
Remember, they are not going to just give you privacy - you have to DEMAND your privacy.
This is just scary. From the article:
GATTICA is here. >shudder< This makes me want to lobby.
-no broken link
When there are criminal penalties, it's very difficult to get them enforced. The only time that government will press charges is in an extreme case or when someone has political connections. This does not provide much of a stick.
By providing a private right of action, along with statutory damages, it makes it easier for an individual to take action. It's very hard, in most cases, to set damages. How can you indicate what damages have occurred when your employer is notified that you took an HIV test and then fired the next day? Prove it was them knowing that you were tested as the reason you lost a job. It's the same as proving it was one item on your credit report that caused you not to get that credit card that includes air-miles.
For the record, the above incidents did not occur.
Fight Spammers!
The best part is the restriction of non-medical use of the information, which should always be by permission. The downside are the release and waiver forms you'll have to sign to get your lab results worked on. This will be reflected in higher costs. Time will tell if it's worth it.
----------------------
Of course, according to this CNN article (via rc3.org), these new rights that we all get will be pretty much worthless, since most HMOs and other insurance plans will require their members to waive their new rights under this legislation in order to keep their coverage.
"I'd like to live in theory, because everything works in theory, in theory." - Can't remember who said this.
First the NSA releases GPL'd security code and now this. It is officially a Good Day (TM).
I almost can't believe it. My natural inclination is to look for some cynical motive, but I just can't find one.
Merry Xmas, Slashdoters...
This makes no mention of places like life insurance companies....the following paragraph is an important one...call your congressman!
THE NEED FOR FURTHER CONGRESSIONAL ACTION
HIPAA limits the application of our rule to the covered entities. It does not provide authority for the rule to reach many persons and businesses that work for covered entities or otherwise receive health information from them. So the rule cannot put in place appropriate restrictions on how such recipients of protected health information may use and re-disclose such information. There is no statutory authority for a private right of action for individuals to
enforce their privacy rights. We need Congressional action to fill these gaps in patient privacy protections.