Think HIPAA protects your privacy? Think again!

Information privacy is a key component to health care quality and is necessary for meeting the Institute of Medicine’s (IOM) triple aim for health care (Berwick, 2009; Peel, 2007). If confidentiality and information privacy are missing, individuals will not have control of what others know about them (Olson, Grudin, & Horvitz, 2005). Individuals want to prevent undue surveillance, halt theft of personal identity, minimize embarrassment and stigma, protect what belongs to them, and limit risk to employment and insurance benefits (Harper 2014; Olson et al., 2005; Reed, 2007). Breaches are harmful, often leading to “privacy protective behavior” or situations where consumers avoid seeking health care services to protect their personal health information (Markel Foundation, 2006). Privacy protective behaviors may increase safety risks, increase medical errors, and lead to poor health outcomes.

Confidentiality and information privacy is deeply rooted in informed consent theory (Berg, Applebaum, Lidz, & Parker, 2001; Mayberry, 2003). Authorization to share or withhold information is based on characteristics found in informed consent: explanation, patient agreement, or refusal (expressed or implied), including disclosure of risks, benefits, and alternatives (Berg et al., 2001; Whitney, McGuire, & McCullough, 2004). Under HIPAA, individual consent or authorization is not required for disclosures related to treatment, payment, or health care operations (TPO; Rothstein, 2007; U.S. Department of Health & Human Services, 2013). Federal privacy and security protections are health care industry specific (covered entity, health care payer, and health care clearinghouse), but not all are easily managed in an information technology environment (Baumer, Earp, & Payton, 2000; Houser, Houser, & Shewchuk, 2007).

Moon, Lisa (2017) Dissertation Research. Health Data Sharing Preferences of Consumers. University of Minnesota.
@phdmoon