In the U.S., we do not, today, have a national privacy law. Pressure from the EU, via the General Data Protection Regulation, and from California, via the California Consumer Privacy Act, are driving an extensive national debate on this topic. But how is this pressure impacting the health care industry, both today and going forward? This two-part series will first explore how we got to where we are today with health care privacy. The second installment, in the next edition of The Privacy Advisor, will assess options for moving forward to address emerging gaps and an evolving health care industry. 

So far, health care data may not be getting enough attention in the debate, driven (in part) by the sense of many that health care privacy already has been addressed. Due to the odd legislative history of the Health Insurance Portability and Accountability Act, however, we are seeing the implications of a law that was driven by considerations not involving privacy and security and also reflected a concept of an industry that no longer reflects how the health care system works today. Accordingly, we are faced with a growing volume of “non-HIPAA health data” across enormous segments of our economy and the challenge of figuring out how to address concerns about this data in a system where there is no specific regulation of this data today.

The substantial history behind the HIPAA experience to date also provides meaningful insight into how a future privacy law could work. There are critical elements of HIPAA that have worked well — for both consumers and industry — and from which we may take lessons for the future. At the same time, the gaps in HIPAA’s protections — mainly the result of a legislative accident and significant technological and industry change — have grown to largely untenable levels. How is health care data being addressed today? How can we begin a dialogue on how these principles should be applied to protect consumers while at the same time permit the critical health care industry to move forward effectively and efficiently?  

Setting the stage

The HIPAA Privacy Rule has set the standard for the privacy of health care information in the U.S. since the rule went into effect in 2003. Despite criticism from various directions, it has fundamentally reshaped the privacy and security environment for the health care industry. 

Yet, from the beginning, the HIPAA Privacy Rule has had important gaps. The Privacy Rule was the result of a series of Congressional judgments about “scope" and driven by issues having nothing to do with privacy, like the “portability” of health insurance coverage and the transmission of standardized electronic transactions. As a result of the HIPAA statute, the Department of Health and Human Services only had the authority to write a privacy rule focused on HIPAA “covered entities” (health care providers, health plans and health care clearinghouses). Meaning, certain segments of relevant industries that regularly use or create health care information were not within the reach of the HIPAA rules. Therefore, the HIPAA Privacy Rule has always been a “limited scope” privacy rule. Bound by the statutory framework, the Privacy Rule focuses on “who” had your health care information rather than the information itself. 

While these gaps existed from the beginning, most components of the traditional health care industry were covered by the HIPAA rules. What has changed in recent years is the enormous range of entities that create, use and disclose health care information outside of the reach of the HIPAA rules. We have reached (and passed) a tipping point on this issue, such that there is enormous concern about how this “non-HIPAA” health care data is being addressed and how the privacy interests of individuals are being protected (if at all) for this “non-HIPAA” health care data.

So, what exactly is the problem?  

Because of the limited scope of the HIPAA statute, a broad range of entities that collect, analyze and disclose personal health information are not regulated by the HIPAA rules. For example, numerous websites gather and distribute health care information without the involvement of a covered entity (meaning that these websites are not covered by the HIPAA Privacy Rule). We have seen a significant expansion of mobile applications directed to health care data or offered in connection with health information or overall wellness. The entire concept of "wearables" post-dates the HIPAA rules and generally fall outside the scope of HIPAA. Unless a HIPAA-covered entity is involved, these activities are generally outside of the scope of the HIPAA Privacy Rule and subject to few explicit privacy requirements (other than general principles such as the idea that you must follow what you say in a privacy notice).

In addition, as “patient engagement” becomes an important theme of health care reform, there is increased concern about how patients view such uses of data and whether there are meaningful ways for patients to understand how their data is being used. The complexity of the regulatory structure (where protections depend on sources of data rather than “kind” of data) and difficulty of determining data sources (which are often difficult, if not impossible, to determine) has led to an increased call for broader but simplified regulation of health care data overall. We see meaningful situations across the health care spectrum that involve data protected by HIPAA at one point and then, through permitted disclosures, no longer receives the protections of the HIPAA rules. These growing gaps call into question the lines that were drawn by the HIPAA statute and easily could lead to a reevaluation of the overall HIPAA framework. 

What can we learn from the HIPAA model?

For better or worse, the core elements of the HIPAA rules can be summarized as follows. HIPAA incorporates a specific set of "covered entities," those companies (or perhaps individuals) directly subject to the law. By defining a set of regulated entities, HIPAA is typical of the sector-specific U.S. approach to privacy law. It then incorporates a means of addressing service providers (first by contract, then by law after legislative change).

One of the key choices in the development of the HIPAA rules — one that some say could be enormously useful model in the development of a national privacy law — involves the approach to consumer consent and related ability of these covered entities to use and disclose regulated information. The idea of “consent” under HIPAA is straightforward: Consent is presumed for certain key areas for uses and disclosures of personal information tied to “normal” operations of the health care industry. For this set of purposes — treatment, payment and health care operations — consent is presumed under the law. This defined set of “permitted” purposes is tied both to “normal” activities that we want to encourage in the health care system (for the benefit of all health care stakeholders) and effective operations of the health care system, consistent with consumer expectations.   

The HIPAA rules also permit disclosures for certain “public policy purposes” (think public health and regulatory investigations), where consumer consent is viewed as not directly relevant. All other uses and disclosures are permitted only with explicit patient permission.   

The HIPAA rules incorporate a series of individual rights (with a continuing focus on the importance of access to the consumer’s information). There are a series of administrative requirements. HIPAA includes a separate set of security principles and breach notification rule. There is primary civil enforcement through the HHS Office for Civil Rights, potential criminal enforcement through the Department of Justice, and parallel civil enforcement through state attorneys general. There is no private right of action.

With this background on the HIPAA rules today, the next part of this two-part series will review alternative options for the regulation of health care data and assess how these choices may develop in the ongoing national privacy law debate. 

Photo by Hush Naidoo on Unsplash