Compliance with HIPAA regulations: ethics and excesses

HIPAA regulations have been seen by many physicians as providing innumerable administrative hoops that require jumping through with no clear benefit for individual patients. Although this article has not comprehensively explored the requirements of HIPAA regulations, it has focused on the issues of "incidental disclosures" that are so important to the daily interactions of physicians and patients. Through the use of illustrative cases, it has been shown that HIPAA regulations frequently are based on well-accepted ethical principles. Although one should never conclude that changing something from an ethical responsibility to a legal responsibility makes it more important, there is no question that HIPAA regulations have forced physicians to consider more carefully how confidential information may be transmitted to others. As such, physicians should look on HIPAA regulations as largely supporting the use of professional judgment in providing good quality medical care. Although not all aspects of HIPAA are grounded in ethical practices, the overall thrust of the HIPAA regulations is consistent with the ethical practice of medicine and surgery. As a result of this general alignment of the legal and ethical requirements, more attention should be directed by physicians at using good judgment in deciding how to disclose private information, rather than adopting an unreasonable approach that confidentiality may never be breached. As Lo and colleagues have very appropriately pointed out: In the context of inadvertent disclosure, the legal risks of good practice are very low. Physicians should work with risk managers and practice administrators to develop policies that promote good communication in patient care, while taking appropriate steps to protect patient privacy. By adopting such an approach to HIPAA, physicians can abide by the regulations while maintaining high ethical standards and minimizing the impact of the new requirements on physician-patient relationships.