Comments on: Health Data Outside HIPAA: Simply Extending HIPAA Would Be a #FAIL https://thehealthcareblog.com/blog/2020/01/20/health-data-outside-hipaa-simply-extending-hipaa-would-be-a-fail/ Everything you always wanted to know about the Health Care system. But were afraid to ask. Tue, 29 Nov 2022 06:19:52 +0000 hourly 1 https://wordpress.org/?v=6.3.4 By: VinceKuraitis https://thehealthcareblog.com/blog/2020/01/20/health-data-outside-hipaa-simply-extending-hipaa-would-be-a-fail/#comment-865372 Thu, 23 Jan 2020 20:16:36 +0000 https://thehealthcareblog.com/?p=97441#comment-865372 In reply to Adrian Gropper, MD.

Adrian, Thank you for commenting and I’m glad that we can agree that HIPAA should not simply be extended to apps & other online platforms.

As to the many other issues you raise, well, not gonna go there; we don’t agree on everything. Readers can decide for themselves.

]]> By: Adrian Gropper, MD https://thehealthcareblog.com/blog/2020/01/20/health-data-outside-hipaa-simply-extending-hipaa-would-be-a-fail/#comment-865370 Tue, 21 Jan 2020 17:28:26 +0000 https://thehealthcareblog.com/?p=97441#comment-865370 I agree that extending HIPAA is a #FAIL. “Innovators” and bureaucrats have been extending HIPAA informally for a long time. Health information exchanges and data brokers like Surescripts are an obvious extension that further dilutes the patient’s ability to know or control how their data is being used. The ongoing attempts to dilute 42CFR Part 2 behavioral health protections are also an example of HIPAA extension. We also have extension of “for operations” data uses to include what is effectively research and the creation of secret intellectual property for profit.

It remains to be seen how much of TEFCA will depend on extending HIPAA.

The Goldilocks Dilemma is due to the lack of consent in HIPAA. It’s wishful thinking that we can build any stable interoperability framework on the basis of HIPAA. It’s easy to understand why but nobody really wants to reopen the HIPAA consent issue in Congress at a time when we have 10 different privacy bills in play on top of various state and international initiatives. Interest in privacy continues to grow, as evidenced in the NY Times series as well as a bit of discussion on the campaign trails.

The net result of lack of consent in HIPAA is a rush by various interests as represented in CARIN Alliance to fill the regulatory void through self-serving definitions of consent. The problem with this is that the CARIN Alliance is replacing open regulatory or political process with intense lobbying by a long list of data brokers eager to act as intermediaries outside of HIPAA.

HIPAA covered entities and their vendors have their lobbies. Data brokers have the CARIN Alliance lobby. What do patients have? Hopefully, a strict interpretation and intense enforcement of information blocking by ONC that promotes practice innovation by clinicians and does it without mandated data brokers.

]]>