| Reports of a federal probe into hospital websites tracking and sharing personal data are putting the landmark HIPAA law in the spotlight — and exposing its limitations, Axios' Erin Brodwin and I report. Why it matters: The Health Insurance Portability and Accountability Act is nearly three decades old. And the bewildering pace of technological change in the years since Congress passed it has left vast amounts of sensitive data being exchanged outside the scope of the law, threatening basic consumer privacy, experts tell Axios. The big picture: HIPAA was designed at a different time and specifically for the data stored and shared by traditional health care organizations. - But today, consumers may have their personal information stashed in a digital app, discussed in a social media group and monitored by a phone or wearable device. All are not covered by HIPAA.
- Most consumers, moreover, don't distinguish between a message sent to a hospital patient portal (protected by HIPAA) and one sent over a digital health app (not protected).
"It's like cars before seat belts," Venrock partner Bob Kocher told Axios. "There was no direct-to-consumer health care when HIPAA was written." Zoom in: In one example from a study published Monday that prompted the civil rights investigation, the vast majority of public-facing websites of hospitals — which do fall under HIPAA — allowed third-party companies to track data. - "My working theory is that nobody thought about it too hard. This just kind of became standard practice," said Ari Friedman, lead author of the study. "That's how the web works."
- It can create real harm for patients, though, as any online activity is increasingly scooped up by AI-powered algorithms and used, for instance, to calculate risk scores used by employers or landlords, Friedman said.
- "Many people, including me, are worried about bad consequences — your employment is terminated or you're charged higher rates for a product," says Harvard Law health law expert I. Glenn Cohen.
What's next: Private industry will likely need to develop mechanisms outside HIPAA to protect health data, says former chief privacy officer for the Office of the National Coordinator for Health IT Lucia Savage, who is now chief privacy officer at Omada Health. - The HHS Office of Civil Rights (OCR), which oversees the law, is slow-moving when it comes to policymaking, she said.
- And legal precedent, including a 2009 lawsuit brought by the health IT company Ciox that prompted a weakening of some components of the privacy protection law, show the limit of OCR's power.
- OCR "can't just say: 'We cover all health information.' They have authority in that box that is the health care system," said Savage.
What's happening: Standard Care CEO and former Enzyme vice president Ryan Stellar said he's attempting to create a platform that will enable users to share certain health data with specific health care vendors. - He and his company are currently developing a system in which a user's specific permissions get logged in a kind of consent ledger that health care vendors would have access to.
- "In the long term we'd like health data privacy to be as implicit to the web as HTTP. Very sophisticated security standards that you don't think twice about and use multiple times a day," Stellar says.
What to watch: The Federal Trade Commission has signaled plans to enforce privacy for health companies that fall outside HIPAA's jurisdiction, as it did with Better Help and GoodRx. | 
No comments