Recently, at my local Starbucks I asked the young barista behind the counter about a chronic medical problem she had that will soon require surgery. Her answer left me gobsmacked, ‘Management said I can’t talk about my health – it’s a HIPAA violation.”

This shows what a farce things have become with HIPAA, the 1996 Health Insurance Portability and Accountability Act. Forget for a moment the kind of management that mandates such tosh. From the outset this law has been poorly understood and badly implemented.

Medical confidentiality has been the cornerstone ensuring free communication between patient and physician since Hippocrates, 2500 years ago. Confidentiality guaranteed interests of patents and caregivers were aligned so doctors could treat patients privately.

For decades, the privacy model was your medical record stored as paper charts, reasonably securely in an office or hospital basement. Of course, some malefactor might be able to peek at your medical record, surreptiously remove it and generate a few copies, a la the Pentagon Papers. But there were few lawsuits or serious public incidents. It wasn’t the most efficient way of maintaining medical privacy but hospitals, doctors and clinics maintained the traditional presumption of confidentiality and, within reason, it worked well.

Then came HIPAA. HIPAA’s original purpose was to guarantee medical confidentiality for people changing jobs and health insurance. The law of unintended consequences set in almost immediately. To err may be human but to foul up on a truly massive scale requires Government micromanagment.

Today virtually no one, including privacy experts, understands the law, which required 25 pages just to summarize on a Government website. By 2003, when many caregivers converted to electronic medical records, the government issued a 100-plus page administrative simplification for HIPAA.
Naturally, hospitals became terrified of running afoul of the Feds. So they overreacted by spending huge sums of money generating forms, and hiring compliance officers and special staff. Conferences, seminars, and courses teaching medical privacy became an overnight cottage industry (Powerpoint forever!). HIPAA embodied the adage that what begins as a movement, becomes a business, and ultimately degenerates into a racket.
Tangling with HIPAA has become a nightmare for patients and families. Put on the defensive, hospitals and medical personnel apply the rules arbitrarily and overzealously, assuming that withholding information is less risky than disclosing it. I’ve seen families encounter difficulty obtaining information about dying relatives in other cities. Occasionally they aren’t even allowed to visit. Clergy has trouble visiting sick patients because they are refused patients’ room numbers. Patients are denied copies of their own medical records or must pay exorbitant sums to retrieve them. The New York Times even noted nursing homes were cancelling residents’ birthday parties because revealing a person’s date of birth could be a HIPAA violation.
Besides this, medical research has suffered. HIPAA, or fear of HIPAA, has made it cumbersome to do long-term tracking of patients enrolled in studies and more difficult to write case reports for medical journals about rare diseases.

Not surprisingly, insurers have no difficulty looking at your records. They regularly negotiate compromises about medical disclosure with caregivers (you have become little more than a middleman between providers and payers, in case you haven’t noticed). A Department of Health and Human Services official admits the department has received thousands of complaints about privacy violations but rarely investigates anything other than problems with patients who have been denied their own records. Virtually no large organization has been cited for violating federal privacy rules.

All this doesn’t even make your health records more confidential. The electronic medical record, promoted to improve care and save money, may or may not live up to its hype as better than paper. But once scanned, computerized and accessed, almost any electronic record can be easily copied and distributed immediately anytime to anyone, anywhere.

Nor does the electronic medical record provide the privacy lawmakers assume. Deleting a name and social security number does not guarantee anonymity. Computer scientists have demonstrated they can reidentify these “anonymous” patients quite easily.

Put simply, HIPAA should be scrapped – it’s caused more problems than it’s solved. In its stead, the DHHS and individual states should create offices to investigate and enforce confidentiality through simplified laws carrying stiff fines and criminal penalties for violators. Patients can still file civil lawsuits if they feel they are victims of privacy violations. Admittedly, scrapping HIPAA is unlikely now, with the Government preparing to invest nearly a trillion dollars annually in healthcare.

In the movie No Country For Old Men, Javier Bardem’s character asks a man he’s about to kill, “If the rule you followed brought you to this, of what use was the rule?” Of what use is the rule when the simple greeting “How are you?” may soon become a perceived HIPAA violation?
=

Have PoliticalMavens.com delivered to your inbox in a daily digest by clicking here