Hipaa Privacy Quotes

Wellness programs offer important benefits, but these data policies underscore the less visible and more dangerous privacy risks they pose.82 Most are exempt from traditional health data privacy regulations. The Health Insurance Portability and Accountability Act of 1996 (known as HIPAA), for example, protects individuals’ identifiable health information in the United States. But it doesn’t apply when employers offer workplace wellness programs directly rather than in connection with their group health plans. Without laws preventing them from using the data collected through wellness programs, employers can mine the data they collect, which many do with abandon.83 Employers learn everything that employees share in the questionnaires and online surveys they complete as part of these programs, from what prescription drugs they use to whether they voted and when they stopped filling their birth control prescriptions.84 And employers are using that data in increasingly more intrusive ways.

During an interview with Diversity Inc.’s director of research and product development, she walked me through a typical presentation used to pitch the value of the company’s software to prospective clients. I learned that their products are especially valuable to those industries not allowed to collect ethno-racial data directly from individuals because of civil rights legislation that attempts to curb how these data are used to discriminate. But now those who work in finance, housing, and healthcare can use predictive software programs to ascertain information that they cannot request directly. The US Health Insurance Portability and Accountability Act (HIPAA) privacy rule, for example, strictly monitors the collection, storage, and communication of individuals’ “protected health information,” among other features of the law. This means that pharmaceutical companies, which market to different groups, need indirect methods to create customer profiles, because they cannot collect racial-ethnic data directly. This is where Diversity Inc. comes in. Its software programs target customers not only on the basis of race and ethnicity, but also on the basis of socioeconomic status, gender, and a growing list of other attributes. However, the company does not refer to “race” anywhere in their product descriptions. Everything is based on individuals’ names, we are told. “A person’s name is data,” according to the director of research and product development. She explains that her clients typically supply Diversity Inc. with a database of client names and her team builds knowledge around it. The process, she says, has a 96 percent accuracy rate, because so many last names are not shared across racial–ethnic groups – a phenomenon sociologists call “cultural segregation.”18