Location: New Orleans, La
A few days ago, I got a phone call from a local college student asking me to participate in a research study on (insert medical diagnosis here). At first, I was confused…how did they know I even HAD (insert medical diagnosis here), so I asked. She said they were partnering with my insurance company – Blue Cross Blue Shield. I was very upset about this – and told her so – I explained that I wasn’t upset with her, but upset with this breach in my right to privacy and confidentiality. They obviously gave her my medical diagnoses and contact information. She said she would hold the information in confidence, but understood why I was upset. The more I think about it, the more upset I get.
Shouldn’t they have at least asked my permission before giving out such personal info???
(I cross posted this to Am I Overreacting)
Comments
This may be(not definitive) a violation of your rights under HIPAA.
You can file a complaint at this address: https://share.google/uGBXiksndalDDze3X . You can also file a complaint with the provider and ask them why they felt this was an appropriate disclosure.
The HIPAA Privacy Rule allows them to disclose your PHI to conduct research studies.
If it helps, the criteria for disclosure and the controls on the data are pretty tight. They must convince an IRB that it is required to conduct the study and poses a minimal risk; not disclose the data to anyone else; and destroy their copy as soon as it is no longer needed.