Medical Community & Government Stripping Medical Privacy Rights??

Evening all.

I wanted to share an experience I encountered today and see if anyone else feels this is as serious as I do.

I went for a regular routine physical - no medical complaints, just a routine check-up. As I'm talking with the doctor, he starts rambling off of his computer all of the medications I've been prescribed by various doctors over the past year or so, none of which are in any of the controlled substances categories.

I was shocked and really couldn't understand the reason why he had access to this information since:
a) I was not there asking for any prescriptions, and
b) Why should this doctor have access to my private medical information from another doctor if I never provided such consent?

According to the Health Insurance Privacy and Protection Act (HIPPA), as explained on the Department of Human Health & Services website here:

Your Health Information Is Protected By Federal Law

Most of us believe that our medical and other health information is private and should be protected, and we want to know who has this information. The Privacy Rule, a Federal law, gives you rights over your health information and sets rules and limits on who can look at and receive your health information. The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral. The Security Rule, a Federal law that protects health information in electronic form, requires entities covered by HIPAA to ensure that electronic protected health information is secure

Who Must Follow These Laws

We call the entities that must follow the HIPAA regulations covered entities.

Covered entities include:

•Health Plans, including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid.
•Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
•Health Care Clearinghouses—entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.

OP Note: this doctor's office maintained electronic records

Who Is Not Required to Follow These Laws

Examples of organizations that do not have to follow the Privacy and Security Rules include:
•life insurers,
•employers,
•workers compensation carriers,
•many schools and school districts,
•many state agencies like child protective service agencies,
•many law enforcement agencies,
•many municipal offices.

How Is This Information Protected

•Covered entities must put in place safeguards to protect your health information.
•Covered entities must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose.
•Covered entities must have contracts in place with their contractors and others ensuring that they use and disclose your health information properly and safeguard it appropriately.
•Covered entities must have procedures in place to limit who can view and access your health information as well as implement training programs for employees about how to protect your health information

Who Can Look at and Receive Your Health Information

The Privacy Rule sets rules and limits on who can look at and receive your health information

To make sure that your health information is protected in a way that does not interfere with your health care, your information can be used and shared:
•For your treatment and care coordination
•To pay doctors and hospitals for your health care and to help run their businesses
•With your family, relatives, friends, or others you identify who are involved with your health care or your health care bills, unless you object
•To make sure doctors give good care and nursing homes are clean and safe
•To protect the public's health, such as by reporting when the flu is in your area
•To make required reports to the police, such as reporting gunshot wounds.

OP Note - what a highly ambiguous statement this is. So, if I go to a podiatrist for let's say an infectied hang nail that's caused a systemic infection for which he/she has prescribed an antibiotic cream, and gave the doctor no authorization to provide this information to my general practitioner, they are allowed to share this information anyway? Why? It's not a controlled substance and can't interact in any detrimental way with other medications. Does this satisfy "for your treatment and care coordination".

Your health information cannot be used or shared without your written permission unless this law allows it.

OP Note - another ambiguous provision which kind of makes the law moot, no?

I read the entire HIPAA Privacy Rights pamphlet they provided to me from front to back and there was no section in which you could even assign a release of this information to any other doctors and I didn't list anyone on the separate "disclosure of health information" sheet.

I could understand, but not necessarily advocate, laws where pharmacies have access to certain shared information, especially where they need to ensure that there are no dangerous drug interactions or when controlled substances are involved in order to curb "doctor hopping" for those would want to acquire and sell the substances illegally, but how is this possibly comparable?

Am I overreacting? Your thoughts are appreciated!

Timigdal

reply to post by timidgal


Your post is very interesting. I work for a large healthcare company and am very familiar with HIPAA. If you are SURE you didn't sign a release to have this information sent to your doctor you are well within your rights to know how the information was obtained. The original doctors office should have a release of information on file if they sent another office the information. That being said, are these physicians part of the same network or organization? If so, that could explain things as well.

reply to post by AllInMyHead

Yep - I was a corporate benefits broker for 20+ years and know most of their "trickS". I ALWAYS make sure not to sign this document (which they always try to bury by inundating you with way too many forms).

TG

reply to post by timidgal


I was shocked and really couldn't understand the reason why he had access to this information since:
a) I was not there asking for any prescriptions, and
b) Why should this doctor have access to my private medical information from another doctor if I never provided such consent?

First off, I'm not specifically calling you out on this but you have people who post every minute of everyday on Facebook but feel their physicians should not be privy to a patient's entire medical record? This is insane, quite frankly. Yes, your physician, and all your physicians, should have a right to see your entire medical record. Should there be a consent process in place? Perhaps. How did they obtain this? I don't have an answer for you. Some health systems have computer networking in-place allowing for the easy transfer of medical information from one physician/office to another. My experience where I live is that this is not the norm yet. There are lots of clinical situations, extending beyond controlled prescriptions in which your physician needs access to your entire medical record. In fact, there are a multitude of everyday medications beyond controlled substances in which are more dangerous than narcotics, or other controlled prescriptions.

When patients start attending four years of pre-med, and then fours of medical school, then three to five years of residency, then take their boards and start practicing medicine, then and only then, will patients be educated enough to determine how much of their chart is medically necessary enough for a treating and diagnosing physician to make good clinical decisions for their patients.

Originally posted by Cosmic911
reply to post by timidgal

First off, I'm not specifically calling you out on this but you have people who post every minute of everyday on Facebook but feel their physicians should not be privy to a patient's entire medical record? This is insane, quite frankly. Yes, your physician, and all your physicians, should have a right to see your entire medical record. Should there be a consent process in place? Perhaps. How did they obtain this? I don't have an answer for you. Some health systems have computer networking in-place allowing for the easy transfer of medical information from one physician/office to another. My experience where I live is that this is not the norm yet. There are lots of clinical situations, extending beyond controlled prescriptions in which your physician needs access to your entire medical record. In fact, there are a multitude of everyday medications beyond controlled substances in which are more dangerous than narcotics, or other controlled prescriptions.

Completely erroneous comparison about FB. There's an implied blanket permission provided by the poster (included in FB's terms and conditions), whereas the release of private health information requires a specific authorization.

Why should they have a RIGHT to see my entire medical record? You may not have a problem with their having that type of access, but I believe that many people will. Also, I'm not asking how they obtained this information because it's obviously stored in some database they all have access to, which futhers my position.

If the types of clinical situations you describe should arise, it should be the patient's responsibility to provide the information. For anyone who would cite "malpractice lawsuits" and the such, this is malarky because if you, as the patient, didn't disclose the information, you should be responsible if a mistake should occur.

This is not about the rationale of the matter at hand, but the ethicacy of the unauthorized sharing of private health information.

With respect to medications outside the classification of narcotics, this is why I said I can understand a centralized database used by pharmacies, but that doesn't change the fact that it's contrary to what the HIPPA language allows.

When patients start attending four years of pre-med, and then fours of medical school, then three to five years of residency, then take their boards and start practicing medicine, then and only then, will patients be educated enough to determine how much of their chart is medically necessary enough for a treating and diagnosing physician to make good clinical decisions for their patients.

Again, this is not an argument about the training that goes into becoming a competent doctor, but a discussion about a specific law which seems to exclude the practice I've described.

"Completely erroneous comparison about FB."
No it's not. It demonstrates how stupid the public and this country has become.

"Why should they have a RIGHT to see my entire medical record?"
When you become a healthcare professional, you'll come to understand. Until then, let the professionals do their jobs.

"If the types of clinical situations you describe should arise, it should be the patient's responsibility to provide the information." This is a little laughable...because patients are Not doctors. It's the doctor's job to provide a safe clinical experience for the patient, not the other way around.

This is not about the rationale of the matter at hand, but the ethicacy of the unauthorized sharing of private health information."

"With respect to medications outside the classification of narcotics, this is why I said I can understand a centralized database used by pharmacies, but that doesn't change the fact that it's contrary to what the HIPPA language allows." HIPPA falls short is many areas. It doesn't cover all situations.

When patients start attending four years of pre-med, and then fours of medical school, then three to five years of residency, then take their boards and start practicing medicine, then and only then, will patients be educated enough to determine how much of their chart is medically necessary enough for a treating and diagnosing physician to make good clinical decisions for their patients.

I can't stress this point enough.

reply to post by Cosmic911

Firstly, when replying to a specific OP, it's common courtesy to hit the "Reply To" button so that the person has the opportunity to respond to your comments.

"Completely erroneous comparison about FB."
No it's not. It demonstrates how stupid the public and this country has become.

On that, you and I can agree; however, it is still comparing apples to oranges. If you voluntarily choose to post personal information on FB for the world to see, that is YOUR conscious decision (be it idiotic or not) and you automatically give up any expection of privacy. When your private health information is shared without your consent, that is a breach of confidentiality and a violation of law. There's a major difference between the two.

"Why should they have a RIGHT to see my entire medical record?"
When you become a healthcare professional, you'll come to understand. Until then, let the professionals do their jobs.

How incredibly patronizing it is of you to assume that I, or any other of us “little people”, don’t have the intelligence to properly convey information to our healthcare provider(s). I don't need to be a healthcare professional to understand this and you're missing the point. I am the patient - I am the one employing the services of the doctor for which he/she is being compensated. It's amazing to me that people lose sight of the fact that any service provider, whether it be in healthcare or any other industry, is still providing a service to the client, in this case, the patient. It is the patient who should ultimately have control and the right to decide who has access to his/her private health information. You have taken the impetus of my original post and skewed it because, for some reason, you seem to be personally offended by my statements. This is not about who is more qualified to decide on an appropriate course of medical treatment, but who has the right to decide where and with whom a patient's private health information is disseminated. That is a right which should remain with the patient.

"If the types of clinical situations you describe should arise, it should be the patient's responsibility to provide the information." This is a little laughable...because patients are Not doctors. It's the doctor's job to provide a safe clinical experience for the patient, not the other way around.

You keep losing sight of the original impetus for this post. Not at the cost of a patient's privacy rights. I admire your comment that it's the doctor's job to provide a safe clinical experience - they are hired and compensated to provide this service to the best of their ability; however, it is the patient's right to retain control of their private health information and who also needs to assume some responsibility in this process as well. In a perfect world where medical history isn't often times used against an individual in so many aspects of life, I would agree with your overall philosophy but, unfortunately, we do not live in a perfect world. The patient has the right to protect him/herself from discrimination based on the unauthorized sharing of private health information. That was the purpose of the HIPPA law. Period.

"With respect to medications outside the classification of narcotics, this is why I said I can understand a centralized database used by pharmacies, but that doesn't change the fact that it's contrary to what the HIPPA language allows." HIPPA falls short is many areas. It doesn't cover all situations.

You don't need to make a blanket statement to me about the HIPPA laws as my own personal background and involvement in the writing and interpretation of such laws in the 90’s make me highly qualified to comment on them. I am well aware that there are gaps in the law and that subsequent modifications weakened the original language in some areas, but this is not one of those areas.

When patients start attending four years of pre-med, and then fours of medical school, then three to five years of residency, then take their boards and start practicing medicine, then and only then, will patients be educated enough to determine how much of their chart is medically necessary enough for a treating and diagnosing physician to make good clinical decisions for their patients. I can't stress this point enough.

Again, you have lost sight of the topic at hand which is the unauthorized release of private health information. This is not a debate over anything beyond that scope.

For one thing, the doc should know about your current medications before he can prescribe you anything since drugs can have some serious combined effects. Also there would be notes in your medical history about drugs which don't suit you for whatever reason.

Now, the doc always could ask you straightforward about those, but some people are reluctant to discuss their medications (present or past) or they've forgotten or whatnot.

I think it's better to be on the safe side.