As much of what is written about patient privacy, this is incorrect. Leaving aside the assertion that the primary protector of patient privacy is the Hippocratic Oath, even as a legal rule, HIPAA is not primary. It is cleary superceded by state statues where they are more stingent than HIPAA–and most are in at least some respects. It is also trumped by physician’s obligations established in common law.

In other words, you can be Hipaa compliant and still unethical and illegal and get your socks sued off of you. You just won’t be fined by the feds for violating HIPAA.

No doubt they’ll come up with some sort of specious ‘opt-out’ program, but like end user licenses, it’ll be buried in fine print and lawyer double-talk.