Thanks for your reply, Tom, and for your insight into the matter. Psychological session notes are just one area where release of information could have serious impact upon the individual, not to mention the chilling effect on the patient who becomes aware of how many people can access such information.

HIV/AIDS is another obvious area of concern. Since HIPAA can override state law in many cases, do those states who have instituted strong protections for consumer's HIV status information lose the ability to protect that information? Will people avoid getting tested as a result of fears of potential exposure of their private information?

And the information will be exposed. Human beings are curious animals, and if the information is there, sitting readily available on some server someplace, someone will decide to access it.

That may be, Kali, but what about all the others who potentially have access to those records. It's not just your doctor who can access them under HIPAA, you know.

I worked briefly for a mail order pharmacy that called doctors and convinced them to change x to y without the patient's knowledge or permission. We did it automatically unless the patient read the fine print carefully and checked a box stating they do not want us to perform this cost saving "service."

That's right. You have to check a box if you do not want your pharmacy to call the doctor behind your back and get your expensive prescriptions changed to cheaper ones.

As a pharmacist in the customer service call center, part of my job was to defend this corrupt and dishonest practice to the hundreds of angry callers who'd found a surprise prescription in their mailbox. I only lasted 3 months.

You're completely correct, dick, that there are positive uses for a national medical records database as well as the potentially negative ones I've focused on here. That's why I don't reject the idea of a national database outright. Still, the privacy issues must be resolved first.

But I personally think your negative scenario was something of a softball. What about this: a woman tests a second time to correct her first false positive test for HIV, but only the first test is recorded in the database. Although her potential new employer never tells her, this was the reason she was turned down for that better paying job she applied for. (Or, even worse, the reason she lost the job she has now.)

Thanks, cheesenstein.

Yet there appears to be little awareness among the general public that there's still a problem. They seem to have gotten the wool pulled over their eyes by GWB's so called HIPAA Privacy Rule. I'm not certain anyone is really paying attention. If we go to a national database without fixing this first, the privacy problems will be multiplied a thousand times, and we'll have far less of an opportunity to fix them.

Interesting ideas there, Gregor. Ostensibly, the HIPAA Privacy Rule said that a PHI was the property of the patient, not the physician, so even though that doesn't seem to be the mindset of the typical medical provider as yet, your proposal makes a lot of sense. My understanding is that there are already some very good medical organizations that require anyone accessing a patients record do so through their own employee's computer account - they have to sign in and provide a password - so a record is created each time there's access, but your idea takes things a big step further.

The health organizations like the one I mentioned above are taking good steps to protect the patient's privacy, and there are some of those. But there are probably just as many or more organizations with decision makers who will interpret the very vague language in the HIPAA Privacy Rule according to their own preconceived ideas. Those who believe that doctors own the data, and who have for years worked within a system in which anyone who works in the hospital is seen as having legitimate access to any patient information, are probably going to interpret HIPAA as only allowing more of the same.

I worked for many years in a profession where I regularly interpreted regulations, and noticed that different jurisdictions would often interpret the same regulations in sometimes radically different ways. I realized it had to do with the mindset of the decision makers in the organization; each would interpret based on his/her preconcieved notions of what should be, rather than on the actual language of the reg. I guess that's a long way of saying that we all have our mental filters.

While I agree that there's an seeming problem because financial liability for privacy violations is held by the physician, while it is probably much more frequently the case that the security risk comes from someone much further down the food chain, if the ultimate decision makers (the doctors) don't make the expectations clear, nothing will ever change. That financial risk theoretically provides incentive to make sure there are very good privacy protections in place and that employees are following them (although right now the risk isn't much, because HHS hasn't been enforcing HIPAA). Of course, in larger organizations, where the average doctor is an employee, of say a hospital, many doctors may be unwilling to confront the issue because of a fear of rocking the boat. A well-trained, professional office manager is probably the key here. Your ideas about a PHI data warehouse would just avoid all that anyway.