The HIPAA Privacy Rule is notoriously weak because of its incomplete coverage, numerous exclusions and exemptions, and limited rights for individuals. The three areas in which it provides the most protection are fundraising, marketing, and research. Provisions of the 21st Century Cures Act, pending in Congress, and the Notice of Proposed Rulemaking to amend the federal research regulations (Common Rule), awaiting final regulatory action, would weaken the privacy protections for research. If these measures are adopted, the HIPAA Privacy Rule would have so little value that it might not be worth the aggravation and burden.
Get full access to this article
View all access options for this article.
References
1.
Pub. L. 104-191, 110 Stat. 1936 (1996).
2.
45 C.F.R. Parts 160, 164. The security and privacy provisions are published in 45 C.F.R. Part 164. For simplicity, both the security and privacy provisions are referred to as the HIPAA Privacy Rule.
3.
See B.Lo, L.Dornbrand, and N. N.Dubler, “HIPAA and Patient Care: The Role for Professional Judgment,”JAMA293, no. 14 (2005): 1766-1771 (describing some of the misunderstandings by health care providers); J. J.Wilkes, “The Creation of HIPAA Culture: Prioritizing Privacy Paranoia over Patient Care,”Brigham Young University Law Review2014, no. 5 (2014): 1213-1249 (asserting that the Privacy Rule has created “privacy paranoia”).
4.
45 C.F.R. § 164.104.
5.
45 C.F.R. § 164.520.
6.
45 C.F.R. § 164.524.
7.
45 C.F.R. § 164.530(b)(1).
8.
45 C.F.R. Part 164, subpart C.
9.
45 C.F.R. Part 164, subpart D.
10.
45 C.F.R. § 164.508(a)(3).
11.
45 C.F.R. § 164.514(f).
12.
45 C.F.R. §§ 164.501, 164.508, and 164.512(i).
13.
45 C.F.R. § 164.506(c).
14.
J. L.Agris, “Extending the Minimum Necessary Standard to Uses and Disclosures for Treatment,”Journal of Law, Medicine & Ethics43, no. 1 (2014): 263-267.
15.
45 C.F.R. § 164.502(b)(1).
16.
45 C.F.R. § 164.501.
17.
Id.
18.
45 C.F.R. § 164.512(a).
19.
45 C.F.R. § 164.512(b).
20.
45 C.F.R. § 164.512(c).
21.
45 C.F.R. § 164.512(d).
22.
45 C.F.R. § 164.512(e).
23.
45 C.F.R. § 164.512(f).
24.
45 C.F.R. § 164.512(g).
25.
45 C.F.R. § 164.512(h).
26.
45 C.F.R. § 164.512(i).
27.
45 C.F.R. § 164.512 (j). See M. A.Rothstein, “Tarasoff Duties after Newtown,”Journal of Law, Medicine & Ethics42, no. 1 (2014): 104-109 (discussing the deficiencies in the HIPAA Privacy Rule and other laws relating to the obligations of health care providers to take appropriate action when there is a serious and credible threat).
28.
45 C.F.R. § 164.512(k).
29.
45 C.F.R. § 164.512 (l).
30.
M. A.Rothstein and M. K.Talbott, “Compelled Disclosures of Health Information: Protecting against the Greatest Potential Threat to Privacy,”Journal of the American Medical Association295, no. 24 (2006): 2882-2885.
31.
M. A.Rothstein and M. K.Talbott, “Compelled Authorizations for Disclosure of Health Records: Magnitude and Implications,”American Journal of Bioethics7, no. 3 (2007): 38-45, at 40.
32.
45 C.F.R. § 164.514(f).
33.
45 C.F.R. § 164.514(f)(2)(ii).
34.
Fundraising from patients also raises a variety of ethical issues, especially if it involves the participation of health care providers. For example, the AMA Code of Ethics Provides: “Physicians should avoid directly soliciting their own patients, especially at the time of the clinical encounter.” American Medical Association, Code of Medical Ethics § 10.018 (2015).
35.
Unfortunately, there are still incidents of health care providers selling health information or leaking details of the treatments of celebrities and other noteworthy individuals. See C.Ornstein, “Farrah Fawcett Was Right — We Have Little Medical Privacy,”Pro Publica, December30, 2015, available at <https://www.propublica.org/article/farrah-fawcett-was-right-we-have-little-medicalprivacy> (last visited May 9, 2016).
36.
45 C.F.R. §§ 164.501, 164.508(a)(3).
37.
45 C.F.R. § 164.501.
38.
Id.
39.
45 C.F.R. § 164.508(a)(3).
40.
Id.
41.
45 C.F.R. Part 46.
42.
45 C.F.R. § 164.501. The same definition appears in the Common Rule, 45 C.F.R. § 46.102(d).
43.
45 C.F.R. § 164.508(b)(3).
44.
45 C.F.R. § 164.508(c)(1).
45.
45 C.F.R. § 164.508(c)(2).
46.
H.R. 6, 114th Cong., 1st Sess. (2015).
47.
See J.Avorn and A. S.Kesselheim, “The 21st Century Cures Act — Will It Take Us Back in Time?”New England Journal of Medicine372, no. 26 (2015): 2473-2475 (asserting that the provisions dealing with the FDA approval of drugs and devices are unnecessary and would be a threat to the public).
48.
The “public health activities” exception to the HIPAA Privacy Rule permits the disclosure of PHI to a person subject to the jurisdiction of the FDA “for the purposes of activities related to the quality, safety, or effectiveness of such FDA-regulated product or activity.” These purposes include to collect or report adverse events, to track FDA-regulated products, to enable product recalls, and to collect post-marketing surveillance. 45 C.F.R. § 164.512(b)(1)(iii). It does not expressly permit disclosures for research.
49.
Dep't of Homeland Securityet al., “Federal Policy for the Protection of Human Subjects; Proposed Rule,” 80 Federal Register53, 933-54, 061 (2015).
50.
M. A.Rothstein, “Research Privacy under HIPAA and the Common Rule,”Journal of Law, Medicine & Ethics33, no. 1 (2005): 154-159.
See M. A.Rothstein, “Is Deidentification Sufficient to Protect Health Privacy in Research?”American Journal of Bioethics10, no. 9 (2010): 3-11.
55.
“Broad consent” is generally considered to require continuing IRB review for new research protocols. By contrast, “blanket consent” is generally used to refer to the one-time approval proposed in the NPRM. If this provision of the NPRM is finally adopted, the absence of ongoing oversight by an IRB would make the United States an international outlier, as other countries overwhelmingly require true “broad consent.” See Mark A.Rothstein, et al., “Comparative Approaches to Biobanks and Privacy,”Journal of Law, Medicine & Ethics44, no. 1 (2016): 161-172.
56.
See Dep't of Homeland Securityet al., supra note 49, at 53,953.
57.
See H.Fernandez Lynchet al., “Confronting Biospecimen Exceptionalism in Proposed Revisions to the Common Rule,”Hastings Center Report46, no. 1 (2016): 4-5.
58.
Patient Protection and Affordable Care Act, Pub. L. 111-148, 124 Stat. 119 (2010).
