Policy Problem

A. Current Measures

With almost 6 in 10 Americans in today’s world expressing their concern with daily government surveillance on personal information flows, the relation of healthcare to the issue of privacy is answered by one major law: the Kassebaum-Kennedy Act, also known as the Health Insurance Portability and Accountability Act (HIPAA) is a 1996 federal law that establishes the illegality of disclosing patient health information without their consent or knowledge. While HIPAA is a major and precedent law in place for American healthcare by creating privacy standards, it ultimately faces shortcomings in ensuring medical efficiency, accounting for all medical healthcare providers and receivers, and effectively enforcing the penalization of health data surveillance.

The primary feature of HIPAA is that it sets boundaries for healthcare-providing entities in terms of using and collecting covered individuals’ health data and records, also known as Protected Health Information (PHI). Additionally, a secondary feature of HIPAA aims to ensure thorough privacy to patients as it provides rights to individuals to receive and control their health data. However, this secondary goal of HIPAA often slows down the medical care process. The 2019 case of a West Virginian healthcare provider ignoring a parent’s request for their child’s medical data to receive treatment serves as a point of contention for how inefficient HIPAA can cause the medical system to be. It eventually took a federal investigation to determine the validity of a parent seeking their child’s records, suggesting clearer demarcations of accessibility.

Another core issue with HIPAA is its failure to account for all medical institutions to ensure patients’ privacy. The HIPAA currently states that the law covers all healthcare providers and must comply with the requirements of guaranteeing data privacy, including care providers for various medical plans such as dental care, medicare, and health maintenance. In reality, many organizations were revealed since 2009 to have sold health data through methods unregulated by HIPAA such as health devices. Such loopholes and instability in the system, paired with the deceleration of medical efficiency, have caused perspectives that see HIPAA as a fiscally costly and socially futile legislation to arise.

Finally, the core issue of HIPAA is complemented by the two aforementioned problems of inefficiency and loopholes, in which the legislation is not strongly enforced. As with many other data surveillance controversies, the handling of PHI is still a sensitive issue to many American citizens and an important marketing and service-providing tool for health service organizations. The inclusion of all healthcare-related institutions and individuals under the HIPAA law, however, makes it extremely difficult for effective and continuous enforcement to happen in the United States. Much of the complaints about HIPAA regulations from both the citizens and the service providers go unanswered, which ultimately points to the fact that the HIPAA requires specificity in its operation.

B. Recent Developments

This year, Washington, Connecticut, and Nevada have passed laws regarding healthcare privacy, following in the footsteps of California, which, in 2022, expanded its CMIA healthcare privacy plan. In April, Washington signed the My Health, My Data Act, which protects all state residents whose health data is collected in Washington, setting the groundwork for Connecticut and Nevada to follow suit in the months after. The acts restrict how entities collect, use, and process consumer data. Covered entities — businesses in the states, businesses that target citizens of the states, and small businesses (those who collect data of fewer than 100,000 consumers a year or derive less than 50% of their gross revenue from consumer data) —  must be transparent to consumers. This implies a consumer health data privacy policy on their homepage and disclosing how one’s data will be collected, stored, and used. It is critical to note that to sell an individual’s data, entities must obtain valid authorization and, importantly, approval from the consumer, ensuring the confidentiality and integrity of those who do not want their information sold. 

However, the acts will likely have unintended consequences. Given its breadth, the plans may impact several industries that are not typically considered processors of consumer health data. As a result, entities must review the law to confirm they are compliant; otherwise, violations could lead to class action lawsuits and significant fines. Unlike the My Health, My Data Act, Connecticut’s CTDPA and Nevada’s Senate Bill 370 do not include a private right of action entitling individuals to take legal action against entities to receive compensation. In effect, violations will likely be minimal fines for larger entities, damaging the acts’ efficacy. Considering the consequences of healthcare privacy laws and violations, it will be essential to follow developments in the states where these acts exist, as restrictions will likely be altered depending on the extent of the repercussions.

Policy Options

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) act served as an exhaustively detailed framework to safeguard this privacy and ensure data security to its citizens however, due to constant shifts in the healthcare industry, changes in technology, the Covid-19 pandemic and several other factors, constant updates are needed in this kind of legislation.

HIPPA was not meant to be a stagnant form of legislation, and continuous improvements have been made over the years to this 25-year-old bill. In a new White House briefing this year, several potential policy actions concerning HIPAA have been considered. 

Firstly, the Department of Health and Human Services issued a Notice of Proposed Rulemaking to enhance privacy protections under HIPAA, focusing on reproductive health information. The rule aims to prevent disclosure of such information for legal action and safeguard patient-provider confidentiality. This initiative promotes complete and accurate reproductive health information for patients. In particular, the rule would bar sharing an individual’s data for investigation, legal action, or prosecution based on seeking or providing legal reproductive healthcare, like abortion.

The second core issue the briefing discussed was the Protect Students’ Health Information. The Department of Education (ED) is releasing guidance to more than 20,000 school officials, reminding them of their duty to uphold student privacy according to the Family Educational Rights and Privacy Act (FERPA). This guidance emphasizes the requirement for written consent from eligible students or parents before sharing personally identifiable information, encompassing student health data, with certain exceptions. Additionally, ED provides a "know-your-rights" resource to educate students about their privacy rights concerning health records within the school environment.

Officials also discussed the importance of consumer privacy and safeguarding electronic health information in particular, given that these issues tend to be overlooked in the entire HIPAA legislation. The Federal Communications Commission (FCC) is introducing a fresh guide aimed at consumers, offering advice on optimal strategies to safeguard their personal data on mobile devices.The guide also explains how existing FCC requirements protect against disclosing consumers’ sensitive information, including geolocation data, which can be especially important in the context of reproductive health.

Most of the new policy actions the federal government is considering focused particularly on the issue of women’s health in the country. They announced several related efforts to provide access to more accurate health information and promote data related to women’s health more broadly. The mentioned two main avenues to achieve this: Firstly, leveraging maternal health data to address disparities and, secondly, promoting accurate information about reproductive health. 

For example,  FCC commits to the swift implementation of the Data Mapping to Save Moms’ Lives Act, integrating maternal health data into its Mapping Broadband Health in America platform. This effort aims to enhance women’s health, expand broadband access for telehealth, and address disparities in maternal health outcomes. Additionally, HHS plans a new funding opportunity for a national hotline providing accurate reproductive health care information and referrals, especially for Title X program patients.