HIPAA Law Meaningless?

[TriSec]

I work in the Healthcare industry. (disclaimer: www.athenahealth.com First cousin Jonathan Bush, founder and CEO.) This news has just come out about how the Bush "administration" is taking care of our health and insurance information. Of course, this should really come as no surprise, since the original author of the bill was Senator Edward Kennedy (D-MA), way back in 1996. The industry managed to have the onset of the law delayed numerous times. (From 1999 to 2000, to 2002, then finally October 16, 2003).

Medical Privacy law nets no Fines

In the three years since Americans gained federal protection for their private medical information, the Bush administration has received thousands of complaints alleging violations but has not imposed a single civil fine and has prosecuted just two criminal cases.

Of the 19,420 grievances lodged so far, the most common allegations have been that personal medical details were wrongly revealed, information was poorly protected, more details were disclosed than necessary, proper authorization was not obtained or patients were frustrated getting their own records.

The government has "closed" more than 73 percent of the cases -- more than 14,000 -- either ruling that there was no violation, or allowing health plans, hospitals, doctors' offices or other entities simply to promise to fix whatever they had done wrong, escaping any penalty.

"Our first approach to dealing with any complaint is to work for voluntary compliance. So far it's worked out pretty well," said Winston Wilkinson, who heads the Department of Health and Human Services' Office of Civil Rights, which is in charge of enforcing the law.

While praised by hospitals, insurance plans and doctors, the approach has drawn strong criticism from privacy advocates and some health industry analysts. They say the administration's decision not to enforce the law more aggressively has not safeguarded sensitive medical records and has made providers and insurers complacent about complying.

"The law was put in place to give people some confidence that when they talk to their doctor or file a claim with their insurance company, that information isn't going to be used against them," said Janlori Goldman, a health-care privacy expert at Columbia University. "They have done almost nothing to enforce the law or make sure people are taking it seriously. I think we're dangerously close to having a law that is essentially meaningless."

And for everything you could possibly want to know about HIPAA...go here.

[tigereye]

1. I disagree

there is almost extreme compliance in my field (mental health) to the point that no one will tell you ANYTHING without a release, not even when agencies are working together to help someone get services. The point of the law was to improve privacy AND flexibility, and that doesn't seem to have worked very well. Most folks I know are utterly paranoid about this law, and over-enforce it.... while at the same time most people I know were extremely careful to protect confidentiality and privacy prior to the law. It's a quandary.

[LaurenG]

2. I too work in the field and

We wouldn't dream of giving up information without a written consent.

I heard this report this am on the way to work (NPR).

[Sanity Claws]

4. The vast majority are in compliance with the law

However, I think the point of the article was that no serious enforcement actions are being taken against those medical providers who did not take action to make sure records remained confidential.

[varkam]

9. Right

From the way I see it, it's just basically the fear of being prosecuted for violating that keeps people in compliance with the law - not that they will actually be prosecuted if the do violate it.

[Warpy]

6. I was actually glad when these things came out

because we had a tool to tell people who called for patient information that we couldn't divulge it over the phone. You have no idea how nasty family members get when nurses won't discuss second cousin Charlie's gall bladder over the phone. We don't know who you are, you're just a voice over a receiver. Now we can cite a LAW.

But the law is a paper tiger when it comes to institutions. Institutions can get any information they want. It's only individuals who are restricted.

[depakid]

7. "...the law is a paper tiger when it comes to institutions."

Bingo.

I'm SURE the bean counters are now just laughing all the way to their banks- quietly selling our private medical information whenever there's a quid pro quo to be had. Provided- that they've given the obligatory payoff money (campaign contributions) to the right people in the party.

Clearly, the statute needed (and still needs) a private right of action with major damages included (in other words- we could bring suit ourselves)-

[Sanity Claws]

8. Were the violators large companies selling info? Or

were they small medical offices which failed to supervise or train its staff adequately?
If the info was sold, whether by a large or small provider, then definitely penalties should be assessed from the first violation.

[bemildred]

3. I don't believe in the tooth fairy either .... nt

[NMMNG]

5. Hah

In the three years since Americans gained federal protection for their private medical information, the Bush administration has received thousands of complaints alleging violations but has not imposed a single civil fine and has prosecuted just two criminal cases.


I'm not surprised. It's not like the Bush administration cares about privacy in any way. :eyes:

[varkam]

10. Same thing is happening with whistle-blowers

Link