Does HIPAA prevent doctors from sharing statistics?

Question

In the US, where HIPAA prevents doctors from disclosing patient information, can a doctor disclose information about his patients in general, since he's not disclosing information about any specific patient? For instance, can a doctor disclose that out of his X patients in a given year, Y of them have exhibited certain symptoms? Or does HIPAA extend even to generalities where no patients are named?

Answer 1

HIPAA does not apply to aggregated data or data that has been stripped of personally-identifiable information. What is personally-identifiable to the government, you ask?

1. Your name.
2. Anything more specific about your physical location than the first three digits of your five-digit zip code.
3. Month and day portions of dates attributed to individuals. It's still okay that if you're 62, they lump your stats into a 60-65 year olds category.
4. Telephone/fax number.
5. VIN, license plate #, or driver's license #.
6. Serial number of any device used on or in you.
7. Email addresses.
8. SSN.
9. Medical record #s.
10. Fingerprint, retina scan, voice print or any other primary biometric indicator.
11. Health plan #s.
12. Full-face photographs.
13. Any other account-type #.
14. Any other certificate/license #s.
15. Nothing that, if less than the standard set in the above entries, could be combined with something else on the same form to find your identity (ie, the fourth digit of your zip code + a partial fingerprint).
16. URLs/IP addies with any of the above info on it.

Answer 2

HIPAA generally prohibits the disclosure of protected health information (PHI), which mostly means medical records that someone could look at and correctly identify the patient, typically through a name, but also through other information, such as "the patient suffered a heart attack while being inaugurated president on January 20, 2017," or "the patient was found covered in green fur, living in a garbage can outside 123 Sesame Street."

Talking to another doctor, a doctor could likely share statistical information about patients with another doctor, as HIPAA allows disclosures of PHI for "treatment" and "health care operations" (45 CFR 164.502), which includes quite a lot of what's going on these communications:

(1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities (as defined in 42 CFR 3.20); population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;

(2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities;

(3) Except as prohibited under § 164.502(a)(5)(i), underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of § 164.514(g) are met, if applicable;

(4) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs;

(5) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and

(6) Business management and general administrative activities of the entity, including, but not limited to:

(i) Management activities relating to implementation of and compliance with the requirements of this subchapter;

(ii) Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer.

(iii) Resolution of internal grievances;

(iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; and

(v) Consistent with the applicable requirements of § 164.514, creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity.

Talking to someone outside of the hospital, the doctor would generally still likely be able to discuss pure statistical information, unless the statistical information would reveal PHI. So the statement "The ER has seen a 10 percent increase in heart attacks this year" should be fine, but "We have treated zero presidents of the United States for erectile dysfunction since June" would not.

Further, HIPAA specifically allows the disclosure of health information for research purposes, with certain conditions. See 45 CFR 164.512(i).