What in the constitution gives congress the authority to regulate medical privacy when all parties to the transaction: provider, patient, insurer, are in the same state? Nothing in mine that I can read. It must be that new “living constitution” that I keep hearing about. I keep looking for a copy but can’t locate it.

Any additional rules and bureacracy to fix the problem will only make it worse, as the essence of the problem is that there is a federal rule. The is and was no need for a federal rule. There was more privacy before HIPAA with just state law and the threat of lawsuits should duty be breached. Insurers, pharmacies, and other non-clinicians didn’t dare do things then that they have sanction to do now.

Regarding the wanted criminal being in the hospital, the old way was better. First decide what is the right thing to do, then do it, and prepare to defend yourself is sued or challenged. The simple way to deal with that was simply an anonymous phone call to the law, “So an So is at the hospital in room 512″. No personal health information given out–just the location of a fugitive.

To fail to at least do that because of a fear of HIPAA, if the nature of the crimes involved are serious enough that one thinks it ought to be done, is pure cowardice.

The best thing would be to repeal the entire act and start over. As it is, HIPAA has created the specter of punishment where none existed before but with no clear explanation about what was to be prohibited or how one was to go about the complex and varied tasks of small practice and hospital business without being in violation of federal law. Why is anyone surprised its interpretation has led to this or to wild examples of its “implementation?” It is a classic example of bad legislation and bad regulation done by people who don’t have a clue about how or by whom daily health care business has to be done.

It has made a nice employment opportunity for “compliance consultants” though.