Welcome to the Lounge

SeanChupas wrote:

What do we have to worry about?

SeanChupas wrote:

If the threat is real then you should be able to quantify it.

dandy72 wrote:

This whole "nothing to hide/no worries" thing has been debated ad nauseam.

SeanChupas wrote:

If that were true,

Quote:

[S]tarting in 2003, changes made to HIPAA eliminated your right to control the disclosure of your own medical records. The phrase “patient permission” was changed to “regulatory permission.” This one rule change means your medical records can now be disclosed to any "covered entity," including data clearinghouses, accounting firms, law firms, and banks without your permission. In certain circumstances, your employer can obtain “regulatory permission” to view your medical records.

Your medical records can even be released to marketing companies if what they’re selling is related to your condition or how it’s treated; the management or coordination of your care; or involves alternative treatments, therapies, health care providers, or other care settings.

What's more, a federal rule that went into effect in 2006 allows lenders to obtain or use medical information for determining if you qualify for credit. They can’t do it directly, but if they gain access to your medical records, they can legally share it with their "affiliates." This magically converts the data into credit information, not medical data.

Indeed, your “protected health information” can be disclosed without your authorization in 12 different scenarios. Consider this diagram from thedatamaporg[^] showing where the data of “You, the Patient” is shared.

Thus, when you visit a physician or health care facility in the United States, never assume that what you disclose to them will remain private. And the “HIPAA Notice” almost every medical facility requires you to sign as a condition of treatment virtually guarantees your medical records will be used, disclosed, and disseminated without your consent.

You can, of course, request that your physician or other health care provider restrict disclosure of your personal medical data. But they are under no legal obligation to comply. Nor do they have to state a reason for denying your request, or for that matter, respond to it at all. And even if they agree to a restriction, in some cases, they might be prohibited from honoring it.