Medical privacy

With the technological boom, there has been an expansion of the record filing system and many hospitals have therefore adopted new PCMS.[1] PCMS is large medical records that hold many individuals' personal data. These have become critical to the efficiency of storing medical information because of the high volumes of paperwork, the ability to quickly share information between medical institutions, and the increased mandatory reporting to the government.[1] PCMS have ultimately increased the productivity of data record utilization and have created a large dependence on technology within the medical field.

It has also led to social and ethical issues because basic human rights are considered to be violated by the PCMS, since hospitals and health information services are now more likely to share information with third-party companies.[1] Thus, there needs to be a reformation to specify which hospital personnel have the access to medical records. This has led to the discussion of privacy rights and created safeguards that will help data keepers understand situations where it is ethical to share an individual's medical information, provide ways for individuals to gain access to their own records, and determine who has ownership of those records.[1] Additionally, it is used to ensure that a person's identity is kept confidential for research or statistical purposes and to understand the process to make individuals aware that their health information is being used.[1] Thus, a balance between privacy and confidentiality must be kept in order to limit the amount of information disclosed and protect patients' rights by safeguarding sensitive information from third parties.

Sample view of an electronic health record in action.

Electronic medical records are a more efficient way of storing medical information, yet there are many negative aspects of this type of filing system as well. Hospitals are willing to adopt this type of filing system only if they are able to ensure that the private information of their patients is sufficiently protected.[2]

Researchers have found that U.S. state legislation and regulation of medical privacy laws reduce the number of hospitals that adopt EMR by more than 24%.[2] This is due to decreasing positive network externalities that are created by additional state protections.[2] With increases in restrictions against the diffusion of medical information, hospitals have neglected to adopt the new EMRs because privacy laws restrict health information exchanges. With decreasing numbers of medical institutions adopting the EMR filing system, the U.S. government's plan of a national health network has not been fully recognized.[2] The national network will ultimately cost US$156 billion in investments, yet in order for this to happen, the U.S. government needs to place a higher emphasis on protecting individual privacy.[2] Many politicians and business leaders find that EMRs allow for more efficiency in both time and money, yet they neglect to address the decreasing privacy protections, demonstrating the significant trade-off between EMRs and individual privacy.[2]

The three goals of information security, including electronic information security, are confidentiality, integrity, and availability. Organizations are attempting to meet these goals, referred to as the C.I.A. Triad, which is the "practice of defending information from unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction."[7]

In a 2004 editorial in the Washington Post, U.S. Senators Bill Frist and Hillary Clinton supported this observation, stating "[patients] need...information, including access to their own health records... At the same time, we must ensure the privacy of the systems, or they will undermine the trust they are designed to create". A 2005 report by the California Health Care Foundation found that "67 percent of national respondents felt 'somewhat' or 'very concerned' about the privacy of their personal medical records".

The importance of privacy in electronic health records became prominent with the passage of the American Recovery and Reinvestment Act (ARRA) in 2009. One of the provisions (known as the Health Information Technology for Economic and Clinical Health [HITECH] Act) of the ARRA mandated incentives to clinicians for the implementation of electronic health records by 2015.Privacy advocates in the United States have raised concerns about unauthorized access to personal data as more medical practices switch from paper to electronic medical records.[8] The Office of the National Coordinator for Health Information Technology (ONC) explained that some of the safety measures that EHR systems can utilize are passwords and pin numbers that control access to such systems, encryption of information, and an audit trail to keep track of the changes made to records.

Providing patient access to EHRs is strictly mandated by HIPAA's Privacy Rule. One study found that each year there are an estimated 25 million compelled authorizations for the release of personal health records. Researchers, however, have found new security threats open up as a result. Some of these security and privacy threats include hackers, viruses, and worms. These privacy threats are made more prominent by the emergence of "cloud computing", which is the use of shared computer processing power.[9] Health care organizations are increasingly using cloud computing as a way to handle large amounts of data. This type of data storage, however, is susceptible to natural disasters, cybercrime and technological terrorism, and hardware failure. Health information breaches accounted for the 39 percent of all breaches in 2015. IT Security costs and implementations are needed to protect health institutions against security and data breaches.[10]

Although privacy issues with the health screening is a great concern among individuals and organizations, there has been little focus on the amount of work being done within the law to maintain the privacy expectation that people desire.[11] Many of these issues lie within the abstractness of the term “privacy” as there are many different interpretations of the term, especially in the context of the law.[11] Prior to 1994, there had been no cases regarding screening practices and the implications towards an individual's medical privacy, unless it was regarding HIV and drug testing.[11] Within Glover v Eastern Nebraska Community Office of Retardation, an employee sued her employer against violating her 4th amendment rights because of unnecessary HIV testing.[11] The court ruled in favor of the employer and argued that it was unreasonable search to have it tested. However, this was only one of the few precedents that people have to use. With more precedents, the relationships between employees and employers will be better defined. Yet with more requirements, testing among patients will lead to additional standards for meeting health care standards.[11] Screening has become a large indicator for diagnostic tools, yet there are concerns with the information that can be gained and subsequently shared with other people other than the patient and healthcare provider

With the lack of help from the Department of Health and Human Services there is a conflict of interest that has been made clear. Some wish to place individual betterment as more important, while others focus more on external benefits from outside sources. The issues that occur when there are problems between the two groups are also not adequately solved which leads to controversial laws and effects.[15] Individual interests take precedence over the benefits of society as a whole and are often viewed as selfish and for the gain of capital value. If the government does not make any more future changes to the current legislation, countless organizations and people will have access to individual medical information.[15]

In 1999, the Gramm-Leach-Billey Act (GLBA) addressed the insurance privacy debate regarding medical privacy.[16] Yet, there were many issues with the implementation. One issue was that there were inconsistent regulation requirements within the different states due to preexisting laws.[16] Secondly, it was difficult to combine the pre-existing laws with the new framework.[16] And thirdly, in order for the federal government to implement these new rules, they needed state legislature to pass it.[16]

GLBA aimed to regulate financial institutions so that corporations could not affect people's insurance. Because of the difficulty of the implementation of the GLBA, state legislatures are able to interpret the laws themselves and create initiatives to protect the medical privacy.[16] When states are creating their own independent legislature, they create standards that understand the impact of the legislation.[16] If they stray from the standard laws, they must be valid and fair. The new legislation must protect the rights of businesses and allow them to continue to function despite federally regulated competition. Patients gain benefits from these new services and standards through the flow of information that is considerate with medical privacy expectations.[16]

These regulations should focus more on the consumer versus the benefits and political exploitation. Many times, regulations are for the personal gain of the corporation, therefore, state legislatures be wary of this and try to prevent it to the best of their abilities.[16] Medical privacy is not a new issue within the insurance industry, yet the problems regarding exploitation continue to reoccur; there is more focus on taking advantage of the business environment for personal gain.[16]

In 2001, President George W. Bush passed additional regulations to HIPAA in order to better protect the privacy of individual medical information.[17] These new regulations were supposed to safeguard health information privacy by creating extensive solutions for the privacy of patients. The new regulation goals included being notified once an individual's information is inspected, amend any medical records, and request communication opportunities to discuss information disclosure.[17]

However, there are exceptions to when the disclosure of PHI can be inspected. This includes specific conditions among law enforcement, judicial and administrative proceedings, parents, significant others, public health, health research, and commercial marketing.[17] These aspects of lack of privacy have caused an alarming number of gaps within privacy measures.

Ultimately, there is still an issue on how to ensure privacy securities; in response, the government has created new regulations that makes trade offs between an individual's privacy and public benefit. These new regulations, however, still cover individually identifiable health information - any data that contains information unique to an individual.[17] However, non-identifiable data is not covered as the government claims it will cause minimal damage to a person's privacy. It also covers all health care organizations and covers businesses as well.

Additionally, under new HIPAA additions, the state legislation is more protective than national laws because it created more obligations for organizations to follow. Ultimately, the new rules called for expansive requirements that created better safety measures for individuals.[17] Yet, there are still ways that businesses and healthcare organizations can be exempt from disclosure rules for all individuals. Thus, the HHS needs to find more ways to balance personal and public trade offs within medical laws. This creates a need for extra government intervention to enforce legislation and new standards to decrease the number of threats against an individual's privacy of health data.

Patients want to be able to share medical information with their physicians, yet they worry about potential privacy breaches that can occur when they release financial and confidential medical information.[18] In order to ensure better protection, the government has created frameworks for keeping information confidential - this includes being transparent about procedures, disclosure and protection of information, and monitoring of these new rules to ensure that people's information.[18]

Recently physicians and patients have started to use email as an additional communication tool for treatment and medical interactions. This way of communication is not “new”, but its effects on doctor patient relationships has created new questions regarding legal, moral, and financial problems.[19]

The American Medical Informatics Association has characterized medical emails as way to communicate “medical advice, treatment, and information exchanged professionally”; yet, the “spontaneity, permanence, and information power characterizing” role is significant because of its unknown affects.[19] However, the use of emails allows for increased access, immediate aid, and increased interactions between patients and doctors.[19] There are many benefits and negative aspects of using emails; doctors feel a new sense of negative responsibility to respond to emails outside of the office, but also find benefits with facilitating rapid responses to patient's questions.[19]

Additionally, the use of email between physicians and their patients will continue to grow because of the increasing use of the Internet. With the Internet, patients are able to ask for medical advice and treatment, yet issues regarding confidentiality and legal issues come up.[19] Ultimately, emails between a physician and patient are supposed to be used as a supplement for face to face interactions, not for casual messages. If used properly, physicians could use emails as a way to supplement interactions and provide more medical aid to those who need it immediately.[19]

Although many people believe that the technological changes are the reason for fear of sharing medical privacy, there is a theory that states that institutional ideals between doctors and their patients have created the fear of sharing medical privacy information.[20] Although levels of confidentiality are changing, individuals often feel the need to share more information with their doctors in order to get diagnosed correctly.[20] Because of this, people are concerned with how much information their physicians have. This information could be transferred to other third party companies. However, there is a call for smaller emphasis on sharing and confidentiality in order to rid patients from their fears of information breaching.[20] There is a common belief that the confidentiality of one's information also only protects the doctors and not the patients, therefore there is a negative stigma towards revealing too much information.[20] Thus it causes patients to not share vital information relevant to their illnesses.

On July 1, 2012, the Australian Government launched the Personally Controlled Electronic Health Record (PCEHR) (eHealth) system.[21] The full implementation incorporates an electronic summary prepared by nominated healthcare providers along with consumer-provided notes. Further, the summary will include information on the individual's allergies, adverse reactions, medications, immunizations, diagnoses, and treatments. The consumer notes will operate as a personal medical diary that only the individual can view and edit.[22] The opt-in system gives people the option to choose whether to register for the eHealth record or not.[23]

As of January 2016, the Commonwealth Department of Health changed the name PCEHR to My Health Record.

The Personally Controlled Electronic Health Records Act 2012 and Privacy Act 1988 governs how eHealth record information is managed and protected.[24] The PCEHR System Operator abides by the Information Privacy Principles in the Privacy Act 1988 (Commonwealth) as well as any applicable State or Territory privacy laws.[25] A Privacy Statement sets out the application of the collection of personal information by the System Operator. The statement includes an explanation of the types of personal information collected, what the information is used for, and how the information is stored. The statement covers measures in place to protect personal information from misuse, loss, unauthorized access, modification, and disclosure.[26]

Security measures include audit trails so that patients can see who has accessed their medical records along with the time the records were accessed. Other measures include the use of encryption as well as secure logins and passwords. Patient records are identified using an Individual Health Identifier (IHI), assigned by Medicare, the IHI service provider.[26][27]

A 2012 nationwide survey in Australia assessed privacy concerns on patients' health care decisions, which could impact patient care. Results listed that 49.1% of Australian patients stated they have withheld or would withhold information from their health care provider based on privacy concerns.[28]

• How does consent impact privacy?

One concern is that personal control of the eHealth record via consent does not guarantee the protection of privacy. It is argued that a narrow definition, 'permission' or 'agreement', does not provide protection for privacy and is not well represented in Australian legislation. The PCEHR allows clinicians to assume consent by consumer participation in the system; however, the needs of the consumer may not be met. Critics argue that the broader definition of 'informed consent' is required, as it encompasses the provision of relevant information by the healthcare practitioner, and understanding of that information by the patient.[29]

• Is it legitimate to use personal information for public purposes?

Data from the PCEHR is to be predominantly used in patient healthcare, but other uses are possible, for policy, research, audit and public health purposes. The concern is that in the case of research, what is allowed goes beyond existing privacy legislation.[29]

• What are ‘illegitimate’ uses of health information?

The involvement of pharmaceutical companies is viewed as potentially problematic. If they are perceived by the public to be more concerned with profit than public health, public acceptance of their use of PCEHRs could be challenged. Also perceived as problematic, is the potential for parties other than health care practitioners, such as insurance companies, employers, police or the government, to use information in a way which could result in discrimination or disadvantage.[29]

• What are the potential implications of unwanted disclosure of patient information?

Information 'leakage' is seen as having the potential to discourage both patient and clinician from participating in the system. Critics argue the PCEHR initiative can only work, if a safe, effective continuum of care within a trusting patient/clinician relationship is established. If patients lose trust in the confidentiality of their eHealth information, they may withhold sensitive information from their health care providers. Clinicians may be reluctant to participate in a system where they are uncertain about the completeness of the information.[30]

• Are there sufficient safeguards for the protection of patient information?

Security experts have questioned the registration process, where those registering only have to provide a Medicare card number, and names and birth dates of family members to verify their identity. Concerns have also been raised by some stakeholders, about the inherent complexities of the limited access features. They warn that access to PCEHR record content, may involve transfer of information to a local system, where PCEHR access controls would no longer apply.[27]

The privacy of patient information is protected at both the federal level and provincial level in Canada. The health information legislation established the rules that must be followed for the collection, use, disclosure and protection of health information by healthcare workers known as "custodians". These custodians have been defined to include almost all healthcare professionals (including all physicians, nurses, chiropractors, operators of ambulances and operators of nursing homes). In addition to the regulatory bodies of specific healthcare workers, the provincial privacy commissions are central to the protection of patient information.

The privacy of patient information is guaranteed by articles 78 and 100 of legal code 5510.

On the other hand, the Social Security Institution (SGK), which regulates and administers state-sponsored social security / insurance benefits, sells patient information after allegedly anonymizing the data, confirmed on October 25, 2014.[31]

The National Health Service is increasingly using electronic health records, but until recently, the records held by individual NHS organisations, such as General Practitioners, NHS Trusts, dentists and pharmacies, were not linked. Each organization was responsible for the protection of patient data it collected. The care.data programme, which proposed to extract anonymised data from GP surgeries into a central database, aroused considerable opposition.

In 2003, the NHS made moves to create a centralized electronic registry of medical records. The system is protected by the UK's Government Gateway, which was built by Microsoft. This program is known as the Electronic Records Development and the Implementation Programme (ERDIP). The NHS National Program for IT was criticized for its lack of security and lack of patient privacy. It was one of the projects that caused the Information Commissioner to warn[32] about the danger of the country "sleepwalking" into a surveillance society. Pressure groups opposed to ID cards also campaigned against the centralized registry.

Newspapers feature stories about lost computers and memory sticks but a more common and longstanding problem is about staff accessing records that they have no right to see. It has always been possible for staff to look at paper records, and in most cases, there is no track of record. Therefore, electronic records make it possible to keep track of who has accessed which records. NHS Wales has created the National Intelligent Integrated Audit System which provides "a range of automatically generated reports, designed to meet the needs of our local health boards and trusts, instantly identifying any potential issues when access has not been legitimate". Maxwell Stanley Consulting[33] will use a system called Patient Data Protect (powered by VigilancePro) which can spot patterns – such as whether someone is accessing data about their relatives or colleagues.[34]

Since 1974, numerous federal laws have been passed in the United States to specify the privacy rights and protections of patients, physicians, and other covered entities to medical data. Many states have passed its own laws to try and better protect the medical privacy of their citizens.

An important national law regarding medical privacy is the Health Insurance Portability and Accountability Act of 1996 (HIPAA), yet there are many controversies regarding the protection rights of the law.

The most comprehensive law passed is the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which was later revised after the Final Omnibus Rule in 2013. HIPAA provides a federal minimum standard for medical privacy, sets standards for uses and disclosures of protected health information (PHI), and provides civil and criminal penalties for violations.

Prior to HIPAA, only certain groups of people were protected under medical laws such as individuals with HIV or those who received Medicare aid.[35] HIPAA provides protection of health information and supplements additional state and federal laws; yet it should be understood that the law's goal is to balance public health benefits, safety, and research while protecting the medical information of individuals. Yet many times, privacy is compromised for the benefits of the research and public health.

According to HIPAA, the covered entities that must follow the law's set mandates are health plans, health care clearinghouses, and health care providers that electronically transmit PHI. Business associates of these covered entities are also subject to HIPAA's rules and regulations.

In 2008, Congress passed the Genetic Information Nondiscrimination Act of 2008 (GINA), which aimed to prohibit genetic discrimination for individuals seeking health insurance and employment. The law also included a provision which mandated that genetic information held by employers be maintained in a separate file and prohibited disclosure of genetic information except in limited circumstances.

In 2013, after GINA was passed, the HIPAA Omnibus Rule amended HIPAA regulations to include genetic information in the definition of Protected Health Information (PHI). This rule also expanded HIPAA by broadening the definition of business associates to include any entity that sends or accesses PHI such as health IT vendors.

The Health Insurance Portability and Accountability Act (HIPAA) is critiqued for not providing strong medical privacy protections as it only provides regulations that disclose certain information.[36]

The government authorizes the access of an individual's health information for “treatment, payment, and health care options without patient consent”.[36] Additionally, HIPAA rules are very broad and do not protect an individual from unknown privacy threats. Additionally, a patient would not be able to identify the reason for breach due to inconsistent requirements.[36] Because of limited confidentiality, HIPAA facilitates the sharing of medical information as there is little limitation from different organizations.[36] Information can easily be exchanged between medical institutions and other non-medical institutions because of the little regulation of HIPAA - some effects include job loss due to credit score sharing or loss of insurance.[36]

Additionally, doctors are not required to keep patients information confidential because in many cases patient consent is now optional. Patients are often unaware of the lack of privacy they have as medical processes and forms do not explicitly state the extent of how protected they are.[36] Physicians believe that overall, HIPAA will cause unethical and non-professional mandates that can affect a person's privacy and therefore, they in response have to provide warnings about their privacy concerns.[36] Because physicians are not able to ensure a person's privacy, there is a higher chance that patients will be less likely to get treatment and share what their medical concerns are.[36] Individuals have asked for better consent requirements by asking if physicians can warn them prior to the sharing of any personal information.[37] Patients want to be able to share medical information with their physicians, yet they worry about potential breaches that can release financial information and other confidential information and with that fear, they are wary of who may have access.[37]

In order to ensure better protection, the government has created frameworks for keeping information confidential - some of which include being transparent about procedures, disclosure and protection of information, and monitoring of these new rules to ensure that people's information is not affected by breaches.[37] Although there are many frameworks to ensure the protection of basic medical data, many organizations do not have these provisions in check. HIPAA gives a false hope to patients and physicians as they are unable to protect their own information. Patients have little rights regarding their medical privacy rights and physicians cannot guarantee those.[38]

HIPAA does not protect the information of individuals as the government is able to publish certain information when they find it necessary. The government is exempted from privacy rules regarding national security. HIPAA additionally allows the authorization of protected health information (PHI) in order to aid in threats to public health and safety as long as it follows the good faith requirement - the idea that disclosing of information is necessary to the benefit of the public.[39] The Model State Emergency Powers Act (MSEHPA) gives the government the power to “suspend regulations, seize property, quarantine individuals and enforce vaccinations” and requires that healthcare providers give information regarding potential health emergencies".[39]

In regards to Hurricane Katrina, many people in Louisiana relied on Medicaid and their PHI was subsequently affected. People's medical privacy rights were soon waived in order for patient's to get the treatment they needed. Yet, many patients were unaware that their rights had been waived.[39] In order to prevent the sharing of personal information in future natural disasters, a website was created in order to protect people's medical data.[39] Ultimately, Katrina showed that the government was unprepared to face a national health scare.

Many patients mistakenly believe that HIPAA protects all health information. HIPAA does not usually cover fitness trackers, social media sites and other health data created by the patient. Health information can be disclosed by patients in emails, blogs, chat groups, or social media sites including those dedicated to specific illnesses, "liking" web pages about diseases, completing online health and symptom checkers, and donating to health causes. In addition, credit card payments for physician visit co-pays, purchase of over the counter (OTC) medications, home testing products, tobacco products, and visits to alternative practitioners are also not covered by HIPAA.

A 2015 study reported over 165,000 health apps available to consumers. Disease treatment and management account for nearly a quarter of consumer apps. Two-thirds of the apps target fitness and wellness, and ten percent of these apps can collect data from a device or sensor. Since the Food and Drug Administration (FDA) only regulates medical devices and most of these applications are not medical devices, they do not require FDA approval. The data from most apps are outside HIPAA regulations because they do not share data with healthcare providers. "Patients may mistakenly assume that mobile apps are under the scope of HIPAA since the same data, such as heart rate, may be collected by an application that is accessible to their physician and covered by HIPAA, or on a mobile app that is not accessible to the physician and not covered by HIPAA.

In 2000, there was a new surge to add new regulations to HIPAA. It included the following goals: to protect individual medical information by providing secure access and control of their own information, improving healthcare quality by creating a more trust between consumers and their healthcare providers and third party organizations, and improve the efficiency of the medical system through new rules and regulations put forth by the local governments, individuals, and organizations.[40]

The implementation of these new goals was complicated by the change in administrations (Clinton to Bush), so it was difficult for the changes to be successfully implemented.[40] HIPAA, in theory, should apply to all insurance companies, services, and organizations, yet there are exceptions to who actually qualifies under these categories.

Yet, within each category, there are specific restrictions that are different in every category. There are no universal laws that can be easily applied that are easy for organizations can follow. Thus, many states have neglected to implement these new policies. Additionally, there are new patient rights that call for better protection and disclosure of health information. However, like the new rules regarding insurance companies, the enforcement of the legislation is limited and not effective as they are too broad and complex.[40] Therefore, it is difficult for many organizations to ensure the privacy of these people. Enforcing these new requirements also causes companies to spend many resources that they are not willing to use and enforce, which ultimately leads to further problems regarding the invasion of an individual's medical privacy.[40]

The Oregon Genetic Privacy Act (GPA) states that “an individual’s genetic information is the property of the individual”.[41] The idea of an individual's DNA being compared to property occurred when research caused an individual's privacy to be threatened. Many individuals believed that their genetic information was “more sensitive, personal, and potentially damaging than other types of medical information.”[41] Thus, people started calling for more protections. People started to question the how their DNA would be able to stay anonymous within research studies and argued that the identity of an individual could be exposed if the research was later shared. As a result, there was a call for individuals to treat their DNA as property and protect it through property rights. Therefore, individuals can control the disclosure of their information without extra questioning and research.[41] Many people believed that comparing one's DNA to property was inappropriate, yet individuals argued that property and privacy are interconnected because they both want to protect the right to control one's body.[41]

Many research and pharmaceutical companies showed opposition because they were worried about conflicts that might arise regarding privacy issues within their work. Individuals, on the other hand, continued to support the act because they wanted protection over their own DNA.[41] As a result, lawmakers created a compromise that included a property clause, that would give individuals protection rights, but also included provisions that would allow research to be done without much consent, limiting the benefits of the provisions.[41] Afterwards, a committee was created to study the effects of the act and how it affected the way it was analyzed and stored.[41] They found that the act benefited many individuals who did not want their privacy being shared with others and therefore the law was officially implemented in 2001.[41]

In order to solve HIPAA issues within Connecticut, state legislatures tried to create better provisions to protect the people living within the state.[35] One of the issues that Connecticut tried to solve were issues with consent. Within the consent clause, health plans and health care clearinghouses do not need to receive consent from individuals because of a general provider consent form with gives healthcare providers permission to disclose all medical information.[35] The patient thus does not get notification when their information is being shared afterwards.[35]

Connecticut, like many other states, tried to protect individual's information from disclosure of information through additional clauses that would protect them from businesses initiatives.[35] In order to do so, Connecticut legislature passed the Connecticut Insurance Information and Privacy Protect Act, which provides additional protections of individual medical information. If third parties neglect to follow this law, they will be fined, may face jail time, and may have their licenses suspended.[35] Yet, even in these additional provisions, there were many holes within this legislation that allowed for businesses agreements to be denied and subsequently, information was compromised. Connecticut is still working to shift its divergent purposes to creating more stringent requirements that create better protections through clear provisions of certain policies.[42]

In California, the Confidentiality of Medical Information Act (CMIA), provides more stringent protections than the federal statutes.[43] HIPAA expressly provides that more stringent state laws like CMIA, will override HIPAA's requirements and penalties. More specifically, CMIA prohibits providers, contractors and health care service plans from disclosing PHI without prior authorization.

These medical privacy laws also set a higher standard for health IT vendors or vendors of an individual's personal health record (PHR) by applying such statutes to vendors, even if they are not business associates of a covered entity. CMIA also outlines penalties for violating the law. These penalties range from liability to the patient (compensatory damages, punitive damages, attorneys’ fees, costs of litigation) to civil and even criminal liability.[44]

Likewise, California's Insurance Information and Privacy Protection Act[45] (IIPPA) protects against unauthorized disclosure of PHI by prohibiting unapproved information sharing for information collected from insurance applications and claims resolution.

In New Zealand, the Health Information Privacy Code (1994) sets specific rules for agencies in the health sector to better ensure the protection of individual privacy. The code addresses the health information collected, used, held and disclosed by health agencies. For the health sector, the code takes the place of the information privacy principles.

The introduction of a nationwide system for the exchange of medical information and access to electronic patient records led to much discussion in the Netherlands.[46]