HIPAA (Health Insurance Portability and Accountability Act)

United States, federal statute and regulations. The Health Insurance Portability and Accountability Act was signed on 21 August 1996 (Public Law 104-191). Its administrative simplification title produced the Privacy Rule (final in 2000, compliance from 2003), the Security Rule (2003) and, after the HITECH Act of 2009, breach notification and stronger enforcement. Primary text: the Department of Health and Human Services Privacy Rule page and the Congress.gov record of H.R.3103.

What it means in cancer care: covered entities (providers, health plans, clearing houses) and their business associates may use protected health information for treatment, payment and operations without consent, but research use needs the patient's authorisation, an institutional review board waiver, or de-identification under the safe harbour (removing eighteen identifiers) or an expert determination. Genomic data are protected health information when held by a covered entity, and the 2013 Omnibus Rule confirmed that genetic information is health information. Patients have a right of access to their records, reinforced by the 21st Century Cures Act's information-blocking rules.

The arguments: HIPAA is at once criticised as an obstacle to research data sharing and as too narrow, since it does not cover consumer apps, wearables or direct-to-consumer genetic testing companies, and de-identified genomic data can in principle be re-identified. The European GDPR takes the opposite design, regulating the data wherever it goes rather than the holder.