Privacy in the Digital World: Medical and Health Data Outside of HIPAA Protections

Abstract

Increasing quantities of medical and health data are being created outside of HIPAA protection, primarily by patients. Data sources are varied, including the use of credit cards for physician visit and medication co-pays, Internet searches, email content, social media, support groups, and mobile health apps. Most medical and health data not covered by HIPAA are controlled by third party data brokers and Internet companies. These companies combine this data with a wide range of personal information about consumer daily activities, transactions, movements, and demographics. The combined data are used for predictive profiling of individual health status, and often sold for advertising and other purposes. The rapid expansion of medical and health data outside of HIPAA protection is encroaching on privacy and the doctor-patient relationship, and is of particular concern for psychiatry. Detailed discussion of the appropriate handling of this medical and health data is needed by individuals with a wide variety of expertise.

Mobile Applications to Improve Medication Adherence: Existing Apps, Quality of Life and Future Directions

“…Furthermore, some of the popular applications, which retain personal health records, do not even provide a password for security [21]. As the adoption of the mHealth application by patients and health care providers has increased, several studies have investigated state/regulation and concerns/challenges related to privacy and security [21,22,23].…”

“…However, once the patient's data is collected by the healthcare provider, most of the collected data will be disclosed to the software vendor and/or third party sites for appropriate as well as inappropriate purposes (e.g. advertising without the patients' authority) [22]. In this situation, a spy, or also known as a data broker may be involved [20,22,25].…”

“…advertising without the patients' authority) [22]. In this situation, a spy, or also known as a data broker may be involved [20,22,25]. Data brokers do not adhere to HIPAA regulations.…”

“…Once the data are collected, those data are shared with third parties, again, meaning patient personal information can be leaked [20]. Current studies suggest the development of more specific and suitable policies and regulation as well as further investigation seeking ways to improve [20][21][22][23][24].…”

The Complexity of Mental Health App Privacy Policies: A Potential Barrier to Privacy (Preprint)

“…Another study looking at the privacy policies of dementia apps found that over 50% lacked a privacy policy [5]. Privacy policies are of central importance as the majority of health apps live outside of the jurisdiction of national or federal healthcare regulations, meaning that privacy of information collected by a smartphone app is not guaranteed in the same way as information shared with a doctor [6]. The U.S. Department of Health and Human Services acknowledged the scope of this problem in a recent report outlining the extent to which consumers may be unaware of what data they are disclosing when using health-related smartphone apps, who is able to access their data, and how their data may be sold or bartered [7].…”