Hip! HIPAA! Hooray! 
Last week, I visited an old friend and former business colleague. In the past several years, we've occasionally discussed a medical condition with which he is afflicted, and he has asked if perhaps one day he could meet an expert from Hopkins, with the thought of providing a charitable contribution to support research related to this disease. It so happened that last week we could align three hectic schedules to finally enable me to introduce him to the Hopkins physician doing research in this area.
So we all get together and sit down for a visit, but before I can get two words out of my mouth about how opportune it was to have this meeting, the Hopkins faculty member pulls out a one-page, single-spaced, small typeset form and asks my friend to sign it. "What the [censored] is this?" my friend demands. "A HIPAA authorization form," sayeth the doctor of Hopkins. "Before we can talk about your illness I need permission from you to hold this discussion about what might be sensitive personal medical information."
Can this be happening? Few things are more sacred or important to us than preserving the privacy of our medical records. We all want that. But because there were some egregious violations of this trust in the past, the feds jumped on their white horses and rode down Pennsylvania Avenue, papering it with a mile of privacy regulations under the Health Insurance Portability and Accountability Act (HIPAA). Presumably these new regs will save us all from the evil-doing snoops out there who would abscond with our sensitive medical records without our knowledge.
Well intentioned? "You betcha!" as they say in Minnesota. But even the reticent denizens of Lake Woebegone would shout: The implementation of this worthy goal is just plain dumb. Now, even casual conversations about medical conditions become a potential use or disclosure of sensitive medical data, and are therefore covered by HIPAA.
These regulations have the potential to expand medical malpractice suits to a level never previously imagined. A casual conversation like the one we held might lead to a discussion with the medical school development staff in order to put a proposal together for the prospective donor. Without HIPAA consent, however, the prospect could turn around and complain to the federal government (which could fine us), or could sue us under state privacy laws for inappropriate disclosure, even though, as in this case, the doctor (and yours truly) were never involved in the prospect's care.
The future costs of implementing the HIPAA privacy regulations, which for the most part have taken effect only recently, represent a huge unfunded mandate. Certainly, the direct costs of heightened security to protect unauthorized access to your medical records are reasonable and especially necessary in this day of easy electronic access. We expect to pay them and do so. But the indirect costs involved-tracking every conversation and every form of encounter with patients and patient data and maintaining an audit trail-have yet to be calculated. They are going to be enormous. And no doubt the prospect of HIPAA-related fines and litigation will lead to new layers of defensive administrative practices that will even further raise the cost of medicine.
And they ask me why I drink-it's to numb the pain! But don't tell anyone, because if you do, I might have to sue you for unauthorized release of my personal medical information.
