Medical privacy and record-keeping laws before HIPAA

Question

The HIPAA "Privacy Rule" regulates the use and disclosure of an individual's personal health information by covered entities. Were there any laws or regulations governing such use and disclosure before HIPAA? For example: if a doctor's office in 1990 had published the medical records of all of their patients, would they have been breaking any laws, and if so, which ones? Would such a medical practitioner have faced any other kinds of sanctions, such as loss of a license to practice? I assume the answer may have varied by state and would be interested to see what kinds of variety there may have been.

Answer 1

A medical doctor has certain duties as a matter of professional ethics to maintain patient confidentiality, although the duty isn't as absolute as it is in the case of lawyers and priests, for example.

A medical doctor's failure to honor professional ethics requirements related to patient privacy could result in public censure, suspension, or revocation of a medical licenses, in theory at least.

In some circumstances, a patient would have grounds to bring a private lawsuit alleging public disclosure of private facts, which is a common law tort claim, in this situation (although these kinds of lawsuits have always been and remain, rare, mostly due to the difficulty of establishing significant money damages).

Almost all of this would have been a matter of state law and as the question presumes there would have been meaningful variation in both the state statutory remedies available and any common law claims that a patient could bring.

I am not aware of any good summary of pre-HIPPA medical privacy laws, which doesn't mean that there isn't one out there. Some accounts argue that there was absolutely no protection of medical privacy pre-HIPAA (the Health Insurance Portability and Accountability Act) in 1996, and there was indeed no meaningful federal protection of medical privacy. But it is a modest exaggeration to say that there was no protection at any level.

One major factor precipitating the passage of HIPAA was the rise of employer provided health insurance, which started to become widespread in the 1950s for tax reasons and as a way to increase worker pay at a time of strong demand for labor and a strong union movement without being too obvious about it. Employer provided health insurance in non-union shops and outside of manufacturing, usually came later.

Often, prior to the 1960s, health insurance was limited to worker's compensation insurance (or something similar) for work related injuries and illness only, which dates to the very late 1800s and early 1900s. ERISA (the Employee Retirement Income Security Act, a law that governs employee provided benefits) in 1974 was the first major federal legislation in this area and HIPAA was primarily legislation to improve and reform ERISA with medical privacy as only a secondary concern that didn't have implementing regulations in force until 2003.

Pre-HIPAA, the main issue was employer access to private medical data about employees using employer provided health insurance, which would have contractually waived the right to medical privacy. This was an understandable outgrowth of the era when worker's compensation was the primary form of employer provided health care, when an employer had a clear need to know the nature of workplace related injuries and illnesses in order to prevent them from recurring.

Before employer provided health insurance was widespread, the harms that HIPAA sought to address which arose from widespread insurance company access to health records, weren't as much of a concern.

The economics of the medical profession prior to World War II in the U.S. looked fairly similar to what the economics of the dental profession look like today in the U.S. (except that it didn't have large multi-provider franchises). Health insurance and government programs to help provide health care both existed, both a much larger share of health care was provided for cash, and a much larger share of government programs were clinic or hospital based rather than following a health insurance model.

Answer 2

When HIPAA was debated and passed in 1996, there was some opposition by privacy advocates. Some opponents claimed that states were well on their way to strengthening state privacy laws. The industry feared that, and they lobbied the feds for a weaker law (HIPAA) that would override state laws via the Supremacy Clause of the US Constitution. The industry and feds won, and the states and opposing privacy advocates lost.

An example of that was the issue of opt-in versus opt-out for disclosure of your personal health information. Several states were working on laws that each patient would prohibit all disclosures unless the patient signs opt-in document. HIPPA allows disclosure for TPO purposes. T for treatment purposes. P for payment purposes. O for operations purposes, including administration, research, education, fraud investigation, and contractors. There are hardly any people on the planet who don't qualify to get your info under that broad umbrella. HIPPA allows patients to opt-out of such disclosures, by signing an opt-out document when they become a patient. However, HIPAA permits the health care providers to deny treatment to anyone who opts out. In practice, there is a day/night difference between opt-in and opt-out.

Bear in mind, that I'm relating a historical political debate, charged with emotions and opinions, rather than historical facts. Some of the state laws that I referred to were in-progress, not yet in-force. I learned of the opposition to HIPAA by following the USENET privacy forum, in the years 1992-1997, before many people ever heard of the Internet.