Comments Sought by Feb 12 on US Health Privacy Law
January 31, 2019 7:59 AM Subscribe
Imagine your worst enemy. Got them in mind? Ok, now imagine how you'd feel if your medical records were given to that person without your consent. This is a thread about stopping changes the Trump admin wants to make to HIPAA & a confession: I've failed, I need your help. Healthcare system activist and attorney Matthew Cortland@mattbc asks for comments by February 12 on proposed changes to the Federal Privacy Rule (SL: Threadreader App). The purpose of these comments is to persuade the human beings who work at HHS that stripping us of the privacy protections other patients get is a terrible idea that will harm and, literally, kill people.
Here's the bottom line: if @HHSGov makes the changes they're thinking about, patients who have a diagnosis of serious mental illness (SMI) or opioid use disorder (OUD) could have their medical records released without their consent. We have until 2/12 to stop them.
The Trump administration is considering re-writing the federal Privacy Rule to permit healthcare "entities" to disclose, without the patient's consent, confidential medical information to "family members, caregivers, and others." To put that another way: anyone.
...They don't understand the risks of disclosing some of the most sensitive, private, and intimate information about a patient to "family members, caregivers, and others." I believe the most effective advocacy strategy available to us is to make the risks painfully clear to HHS.
The Health Insurance Portability and Accountability Act (HIPAA) is a US law that established privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care providers. Erin Gilmer (@GilmerHealthLaw) is a patient advocate and health policy attorney. Here is her deep dive into possible changes to the HIPAA and what the Request for Information (comments) is all about.
Here is the Federal request for information. Here is a link to where you can file a comment. KEEP IN MIND all comments are public; you can, however, file an anonymous comment as shown in the first link.
Here's the bottom line: if @HHSGov makes the changes they're thinking about, patients who have a diagnosis of serious mental illness (SMI) or opioid use disorder (OUD) could have their medical records released without their consent. We have until 2/12 to stop them.
The Trump administration is considering re-writing the federal Privacy Rule to permit healthcare "entities" to disclose, without the patient's consent, confidential medical information to "family members, caregivers, and others." To put that another way: anyone.
...They don't understand the risks of disclosing some of the most sensitive, private, and intimate information about a patient to "family members, caregivers, and others." I believe the most effective advocacy strategy available to us is to make the risks painfully clear to HHS.
The Health Insurance Portability and Accountability Act (HIPAA) is a US law that established privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care providers. Erin Gilmer (@GilmerHealthLaw) is a patient advocate and health policy attorney. Here is her deep dive into possible changes to the HIPAA and what the Request for Information (comments) is all about.
Here is the Federal request for information. Here is a link to where you can file a comment. KEEP IN MIND all comments are public; you can, however, file an anonymous comment as shown in the first link.
Matthew Cortland is a good person to follow if you look at Twitter at all.
posted by matildaben at 11:15 AM on January 31, 2019 [2 favorites]
posted by matildaben at 11:15 AM on January 31, 2019 [2 favorites]
This has been around since December and I've seen damn near nothing about it, probably because "HIPAA policy proposal" doesn't sound especially exciting. Are practitioners aware of this? Can we strategize re: who should be made aware of this?
posted by atoxyl at 10:22 PM on January 31, 2019 [1 favorite]
posted by atoxyl at 10:22 PM on January 31, 2019 [1 favorite]
Tell your congress critters, share on social media if you have accounts (link to one of the posts above and not MF if you are worried about privacy), share with local media folks (TV, newspapers, radio) if local media outlets cover national health care issues.
You can search for "MEDIA NAME" email format to discover the most common email format used by various media outlets. You can also search those outlets for "health care" to find out if there is a local reporter who covers this topic.
posted by Bella Donna at 5:55 AM on February 1, 2019 [1 favorite]
You can search for "MEDIA NAME" email format to discover the most common email format used by various media outlets. You can also search those outlets for "health care" to find out if there is a local reporter who covers this topic.
posted by Bella Donna at 5:55 AM on February 1, 2019 [1 favorite]
The Senate Committee on Health, Education, Labor & Pensions appears to oversee the Department of Health & Human Services, so you might want to contact any member of that committee who represents your state to share your concerns.
posted by Bella Donna at 6:03 AM on February 1, 2019
posted by Bella Donna at 6:03 AM on February 1, 2019
@ Bella Donna Thank you for posting this!
posted by Katjusa Roquette at 12:02 PM on February 2, 2019 [1 favorite]
posted by Katjusa Roquette at 12:02 PM on February 2, 2019 [1 favorite]
Ugh, the last thing we need is HIPAA protections being rolled back. It already allows far too much sharing of PHI without and/or against patient consent.
Unless a patient is unconscious or declared mentally incompetent and is in immediate need of someone to make decisions regarding care prior affirmative consent should be required before sharing any information whatsoever except maybe very limited biographical information (name/year of birth) and even that kinda bugs me.
The questions regarding mental health and substance use evince an intent not consistent with any reasonable notion of privacy. It's already hard enough to get people to seek care. The contemplated examples are clearly not emergent, so there is no basis to even consider not getting permission to share information explicitly and in advance.
What is needed more than rule changes is educational support for health care providers, employers, and others whose work involves or is adjacent to PHI. The number of large companies that you would think of as probably being smart enough to avoid holding PHI like the plague but in fact have written or unwritten policies that lead to the unnecessary disclosure and keeping of PHI and thereby opening themselves up to possible legal exposure is not small.
Our response to our boundaries being violated should not be to throw out the boundaries. More rules probably isn't a great one either. Enabling meaningful compliance through education and outreach would probably be more effective.
Sadly, while it is important that we comment effectively so that accurate information is on the record, it's only likely to make a difference years down the line in court. We've already seen the FCC, EPA, and Treasury (among others) blatantly ignore the record in their rulemaking proceedings in clear abuses of discretion.
On the bright side, good comments that clearly elucidate on the immediate and irreversible harms a rule change will have make the TRO application that much easier. Even if this fails to get wide attention, it's heartening to see it brought to the attention of Mefites.
posted by wierdo at 12:13 PM on February 2, 2019 [2 favorites]
Unless a patient is unconscious or declared mentally incompetent and is in immediate need of someone to make decisions regarding care prior affirmative consent should be required before sharing any information whatsoever except maybe very limited biographical information (name/year of birth) and even that kinda bugs me.
The questions regarding mental health and substance use evince an intent not consistent with any reasonable notion of privacy. It's already hard enough to get people to seek care. The contemplated examples are clearly not emergent, so there is no basis to even consider not getting permission to share information explicitly and in advance.
What is needed more than rule changes is educational support for health care providers, employers, and others whose work involves or is adjacent to PHI. The number of large companies that you would think of as probably being smart enough to avoid holding PHI like the plague but in fact have written or unwritten policies that lead to the unnecessary disclosure and keeping of PHI and thereby opening themselves up to possible legal exposure is not small.
Our response to our boundaries being violated should not be to throw out the boundaries. More rules probably isn't a great one either. Enabling meaningful compliance through education and outreach would probably be more effective.
Sadly, while it is important that we comment effectively so that accurate information is on the record, it's only likely to make a difference years down the line in court. We've already seen the FCC, EPA, and Treasury (among others) blatantly ignore the record in their rulemaking proceedings in clear abuses of discretion.
On the bright side, good comments that clearly elucidate on the immediate and irreversible harms a rule change will have make the TRO application that much easier. Even if this fails to get wide attention, it's heartening to see it brought to the attention of Mefites.
posted by wierdo at 12:13 PM on February 2, 2019 [2 favorites]
« Older In Search of Emiliano Sala | Remember MySpace‽ Newer »
This thread has been archived and is closed to new comments
posted by SyraCarol at 11:05 AM on January 31, 2019 [2 favorites]