Chances are, like me, you have on countless occasions when entering the office of a new doctor or mental health professional been given a notice of receipt of HIPPA (Health Insurance Portability and Accountability Act) privacy practices but quickly pocketed and then disposed of the added paperwork without reading the fine print.
After all, even with the increased reliance on electronic medical records, rare is the occasion that we can see a new provider without filling out numerous pieces of paperwork on a clipboard. Moreover, the ubiquity of these forms gives us the illusion of insulation against violations by those whom we are entrusting with our care. That was my belief until recently.
Last month, the local police inappropriately, though apparently not illegally, revealed to my employer a sensitive health matter after a 9-1-1 call was made to my university-owned apartment. While I do not have legal training, I am familiar both personally and through my political science research with many areas of the law – particularly health regulations after years of appealing insurance denials – and even so it required consulting with numerous local attorneys and texts to determine my legal standing (or in this case, lack thereof). Put plainly, I learned that patients’ rights advocacy requires a lot of patience.
To begin with, while HIPAA protects against disclosure of health information by covered entities (which do not, for example, include police notified upon the dialing of 9-1-1, but do include doctors, EMTs, therapists, and those involved in patient records), in the event of violations there is in fact limited recourse for the individual due to the Act’s failure to provide for a private right of action. That is, even if suffering the revelation of protected information, one cannot sue directly the entity responsible, but rather must rely on the government agency to investigate the potential violation and prosecute if it deems the situation appropriate.
Congressional reliance on private litigation had a potent impact on individuals’ ability to effectively prosecute claims of employment discrimination under Title VII of the Civil Rights Act of 1964. Thus, rather than rely exclusively on Equal Employment Opportunity Commission prosecution of violations, individuals could bring claims against those by whom they were discriminated and if successful, claim damages and attorney’s fees. Private litigation has likewise been mobilized in other contexts as well, including environmental policy. The potency of private enforcement in other contexts brings to light the important absence of this right in the context of health care protections.
This enforcement structure, ladened with procedural hoops, creates two sets of challenges. The first is the difficulty associated with taking action. One must file a detailed written or electronic complaint with the Department of Health and Human Services Office of Civil Rights (OCR) within 180 days of the violation, at which point the OCR may investigate the purported violation. If the person did indeed suffer a violation of HIPAA, the OCR may require that the given business voluntarily comply with HIPAA, take corrective action, and agree to a settlement. Not only is such a process far from expedient, but it requires savviness on the part of the individual, and claim resolution depends on the OCR’s vigilance in pursuing the claim.
Moreover, absent effective means with which to prosecute, there is not a credible threat of punishment of a covered entity, and this can importantly reshape incentives if there is incentive on the part of that entity not to comply (for example, if there are costs associated with compliance). When failure to adhere to the statute can lead an individual to endure potential embarrassment and emotional distress – and potentially worse, lead to further infringements under the Americans with Disabilities Act – the stakes are too high. And while some cases (e.g., the 2014 Connecticut Supreme Court case Byrne v. Avery Center for Obstetrics and Gynecology) have come to broaden the range of circumstances under which suits may be brought, the case law is in its early stages of development and much progress must still be made.
While often infuriated as a patient navigating the health care system, I can step back and examine these processes through the lens of a social scientist, and am grateful for my ability to negotiate coverage for claims albeit with the potential appeals process. The question remains, however, why is this made necessary? Patient rights are aimed at protecting the vulnerable, and it is in that vulnerable state that navigating labyrinthian procedures and red tape is detrimental to the very purpose it is meant to serve.
After all, even with the increased reliance on electronic medical records, rare is the occasion that we can see a new provider without filling out numerous pieces of paperwork on a clipboard. Moreover, the ubiquity of these forms gives us the illusion of insulation against violations by those whom we are entrusting with our care. That was my belief until recently.
Last month, the local police inappropriately, though apparently not illegally, revealed to my employer a sensitive health matter after a 9-1-1 call was made to my university-owned apartment. While I do not have legal training, I am familiar both personally and through my political science research with many areas of the law – particularly health regulations after years of appealing insurance denials – and even so it required consulting with numerous local attorneys and texts to determine my legal standing (or in this case, lack thereof). Put plainly, I learned that patients’ rights advocacy requires a lot of patience.
To begin with, while HIPAA protects against disclosure of health information by covered entities (which do not, for example, include police notified upon the dialing of 9-1-1, but do include doctors, EMTs, therapists, and those involved in patient records), in the event of violations there is in fact limited recourse for the individual due to the Act’s failure to provide for a private right of action. That is, even if suffering the revelation of protected information, one cannot sue directly the entity responsible, but rather must rely on the government agency to investigate the potential violation and prosecute if it deems the situation appropriate.
Congressional reliance on private litigation had a potent impact on individuals’ ability to effectively prosecute claims of employment discrimination under Title VII of the Civil Rights Act of 1964. Thus, rather than rely exclusively on Equal Employment Opportunity Commission prosecution of violations, individuals could bring claims against those by whom they were discriminated and if successful, claim damages and attorney’s fees. Private litigation has likewise been mobilized in other contexts as well, including environmental policy. The potency of private enforcement in other contexts brings to light the important absence of this right in the context of health care protections.
This enforcement structure, ladened with procedural hoops, creates two sets of challenges. The first is the difficulty associated with taking action. One must file a detailed written or electronic complaint with the Department of Health and Human Services Office of Civil Rights (OCR) within 180 days of the violation, at which point the OCR may investigate the purported violation. If the person did indeed suffer a violation of HIPAA, the OCR may require that the given business voluntarily comply with HIPAA, take corrective action, and agree to a settlement. Not only is such a process far from expedient, but it requires savviness on the part of the individual, and claim resolution depends on the OCR’s vigilance in pursuing the claim.
Moreover, absent effective means with which to prosecute, there is not a credible threat of punishment of a covered entity, and this can importantly reshape incentives if there is incentive on the part of that entity not to comply (for example, if there are costs associated with compliance). When failure to adhere to the statute can lead an individual to endure potential embarrassment and emotional distress – and potentially worse, lead to further infringements under the Americans with Disabilities Act – the stakes are too high. And while some cases (e.g., the 2014 Connecticut Supreme Court case Byrne v. Avery Center for Obstetrics and Gynecology) have come to broaden the range of circumstances under which suits may be brought, the case law is in its early stages of development and much progress must still be made.
While often infuriated as a patient navigating the health care system, I can step back and examine these processes through the lens of a social scientist, and am grateful for my ability to negotiate coverage for claims albeit with the potential appeals process. The question remains, however, why is this made necessary? Patient rights are aimed at protecting the vulnerable, and it is in that vulnerable state that navigating labyrinthian procedures and red tape is detrimental to the very purpose it is meant to serve.
RSS Feed