The Value of Healthcare Privacy In Technological Age
The Health Insurance Portability and Accountability Act (HIPPA), signed into law by President Bill Clinton on August 21, 1996, has been routinely considered.
Updated
On this page
Key takeaways
- The Health Insurance Portability and Accountability Act (HIPPA), signed into law by President Bill Clinton on August 21, 1996, has been routinely considered a model piece of privacy legislation.
- Most recently, in April 2021, the United States Government has now demanded all healthcare organizations to make all patient’s medical records accessible electronically without any charge.
- Yet, only further studies of these trends would confirm if necessary interventions are required.
The Health Insurance Portability and Accountability Act (HIPPA), signed into law by President Bill Clinton on August 21, 1996, has been routinely considered a model piece of privacy legislation. Prior to its creation, a patchwork of both state and federal laws governed the communication, distribution, and use of medical data for patient care and finances. Inconsistencies in these laws allowed the access of these data without any authorization, including personal sanctioning of sharing, from the individual whose data was to be used for the purposes of assessing anyone’s potential for production and maintenance. This was especially relevant in the realm of financial lending and insurance, whereby lenders and insurers can bypass personal subjective assessments to view medical history as a means of assessing stability - determining if a candidate would be sustainable enough to produce a capital gain. This also affected employment opportunities with production being a function of health, often selecting for those without or with minimal complications, even if left undisclosed can easily be evident through this quick access.
Most importantly, individuals lost control over who and where that information was shared and were never notified of its distribution and the level of access the recipients were to have. A loss of control over one’s own data was abundant - a critical problem that has become a greater point of contention in the present. These problems required interventions that would make it easier for communication of health plans, claims, and access to those who should have the need and right to see them.
While respect for healthcare privacy has been a consistent moral imperative among those in the healthcare field, one’s own health is extremely interconnected with access to services and employment required for survival, hence the distribution of this information has become a critical part of economic sustenance. Even if there were minimal health issues that could be managed successfully with limited chances for a complication, having access to that information in the eyes of those not able to determine these intricacies provided an easy opportunity to label and select against. The establishment of HIPPA guaranteed federal protection for all citizens of their personal health information; allowing one to control its distribution, access, and most importantly the level of information sharing to be done. This meant that if employers were to request personal health information as a means of assessing one’s capability - individuals had the right to refuse and protected against being discriminated against guaranteed by law. While there are still continuous cases of employer discrimination, whereby records are accessed without permission or denied after review of records - the fact that these cases exist is evidence of HIPPA working as intended.
The Invisible Rules Within HIPPA: Is It Structuring Personal and Digital Health Privacy For Our Time? #
While HIPPA has had a total of 5 major rules that govern physical and digital health data, two main ones are designed for patient use and personal data protection. The other rules are meant to simplify the process of billing and identification of all parties involved in the patient care throughout their stay - including the provider, health institution, and insurance services.
**(1) The Security Rule:**As the use of electronic health records began to widespread and mainstream - necessary protection was mandated in response to easing the access of patients’ data. Electronic Health Records (EHR) began to run in a closed system, where data could be shared among systems with the same programs. It enabled the access of data to anyone working in the system or who has access to the system without proper procedure. The Security Rule wasofficially complied in 2003, with over the following couple of years created mechanisms for the protection, storage, accessibility, and distribution of these records within each system. These rules mandated both physical and technical securities with both software and hardware.
**(2) The Privacy Rule:**After HIPPA’s establishment, the Privacy Rule, also referred to as the Standards for Privacy of Individually Identifiable Health Information, was established four years after its initial ratification in September 2000. The rule provided increased protection for patient data in research and clinical environments. Going into full effect in 2004 - it offered limitations on disclosures that individuals were permitting the sharing only via certain forms - the ones signed commonly by everyone during healthcare visits. It further goes onto allowing patients to obtain copies of their own records, inspect and permit any changes for accuracy by using certain request forms for this purpose.
The remaining rules that serve to streamline patient care through ensuring provider and system compensation while preventing patient overwilling are:
(A)**Transactions Rule -**More relevant in the eyes of the payers and lenders behind the scenes, this rule mandates the use of standard codes. ICD (International Classification of Diseases), HCPCD (Healthcare Common Procedures Coding System), CPT (Current Procedural Terminology), or NDC (National Drug Codes) codes; all of which are used to standardize diagnosis, medication, treatment, and follow-up services over the scope of a variety of provider and payer systems. This essentially standardizes the language that is used to create efficient and accurate transactions.
(B)**Identifiers Rule -**Designed for simplification, this rule mandates that providers, health plans, and the insurance payers (either federal medicare/Medicaid or private third party) all have specific standard numbers for communication and documentation purposes.
**(C)**Enforcement Rule - If there is any failure in compliance of accurate reporting of negligence in protecting patient data either by the provider/system or limiting transparency in the eyes of the patient, then policies of the Enforcement Rule (also known as the breach notification rule) are used. The enforcement rule defines various tiers of penalties for infractions of rules while also defining reporting and investigation methods for any violation. This serves as an extra layer of protection by defining sanctions and monetary or potentially greater consequences under the law. They outline a certain length of time by which an infraction must be investigated and appropriately resolved per the recommendations that are defined within the law.
(D) Omnibus Rule - Given the constantly changing technological landscape since the time of HIPPA’s establishment, there have been frequent additions to the original provisions in an effort to increase transparency and allow further command of one’s own healthcare. Since the law’s inception, far more efficient electronic health record systems have been developed and continue to be consolidated over a large range of hospital systems - allowing for opportunities for greater access and transparency. Most recently, in April 2021, the United States Government has now demanded all healthcare organizations to make all patient’s medical records accessible electronically without any charge. This includes that all doctor authored notes, reasons for treatment plans, and assessments of patients’ conditions - all to be reviewed by patients. Prior to this, the update in 2013 was the Omnibus Rule, created to better consolidate healthcare systems by mandating specific structures to be developed that collect updated agreements from all involved business associates that a part of the patient care payment process to comply with HIPPA, strengthening the brevity of the existing security rule.
Given these recent changes, patient data protection has been continually advancing alongside a push for increased personal access to better the transparency of data for those sanctioned to access it under HIPPA compliance. These two paradigms can often conflict with each other as more access can leave greater room for unwanted dissemination.
Data Protection Under HIPPA, Are There Any Exceptions? #
A very important point to note is that only those providers and employees receiving compensation through insurance coverage are bound by HIPPA - meaning caretakers and health systems directly involved in reimbursement for patient care are responsible for adhering to the HIPPA laws. This means that those not covered by insurance are not in breach of this privacy law if they share various points of patient data - such as certain providers on medical talk shows. While these providers can still be in breach of state laws, the inconsistencies with those and federal protections can leave many areas to justify no breach and subsequent portions of medical stories that the patient themselves may not have sanctioned.
While the healthcare delivery sector is where HIPPA was developed to provide better protection for health data; other health-related sectors, including fitness & nutrition, are not covered. Even while having personal data recorded by users, protections mandating security to maintain transparency of access is not required. Unlike when HIPPA was first established, technology has allowed individuals to become more aware of what kind of health-related data is relevant to their well-being and the interplay of those data in their own lives. Simple metrics like heart rate and rhythm can now be taken on smartwatches and easily shared among friends or physicians. Blood pressures and blood glucose levels could be monitored at local pharmacies. Health tracking apes are rapidly gaining attention in the fitness sector, which tracks individuals’ weight and caloric intake daily. While many of these metrics are recorded to optimize the app experience to generate better results and create an appealing user experience, these metrics sometimes are used to make critical medical decisions in the hospital setting. Despite their importance, the laxity to which these data are given (which are the same metrics being protected under the regulations of HIPPA) underlies the collective importance placed on health-related data and emphasizes the complexity of privacy, that was not present during the development of the law.
The continued culture of innovation and entrepreneurship in the technological marketplace continues to evolve new start-ups in the healthcare sector that have arisen to simplify the increasing complexity of health care data. Furthermore, its purpose in optimizing patient care has become a favorable use of resources, and continued investment for the use of this data requires that such data be available. Yet, the guidelines in HIPPA that cover the specifics of which data are protected have yet to be updated relative to the brevity and complexity of the types of data that can be used to create innovations to better the healthcare experience. Mainly Protected Healthcare Information (PCI), defined as any data that is a part of an individual’s health profile and can be linked to a said individual, is said to be covered. This means that those data that are not identifiable to any person can be used for research and innovation development. Therefore, while HIPPA protects individual data, there are relatively no legal ramifications if anonymity is maintained on a population scale. The exact format is also used in clinical research involving big data analysis for treatment algorithm optimization or quality improvement, whereby blinded data can be shared upon consolidation from electronic medical records.
Given these exceptions, an argument can be made for the benefit of sharing all data that is not related to identification, yet this is the exact data that HIPPA generally covers. While HIPPA was put into action to protect individuals rights to be assessed more objectively in any societal structure necessary for survival and upward mobility, the question becomes that is its relevance diminished if the health-related data is still shared, but it cannot be attributed to the individuals from which it was collected regardless of the benefits that its collection can have.
Do We Need To, and More Importantly Want to, Update HIPPA? #
Data analysis has lead to remarkable strides in creating personalized technological experiences for almost every technology used on the planet. It has allowed individuals to leverage technical analysis of their data to better their own lives and tailor it to the way they perceive to be the best for them while also optimizing their work for outcomes that they desire. Continued innovation in health-related data has been shown to do the same, as evidenced by numerous testimonies of how the benefits of tracking their own healthcare metrics have helped them optimize and tailor lifestyle and nutrition changes for their benefit. Yet data collection is also concomitantly being used to tailor and target individuals for increasing capital gain and users - such as personalized advertisements that can often be seen favorably by the end-user when they choose to click and purchase said product. This same trend could also occur in fitness and healthcare-related communities with more negative rather than intended positive outcomes for the end-user. While current regulations under health data privacy permit this under the condition that data remain anonymous, to preempt such outcomes - HIPPA may need to be updated. Yet, only further studies of these trends would confirm if necessary interventions are required.
Related reading