How does HIPAA interact with state governors’ demands for COVID-19 test results?

Today is National Pearl Harbor Remembrance Day, marking 79 years since we entered World War II in order to fight Totalitarianism.

Here in Massachusetts, as part of our governor’s more-than-50 orders, we are required to tell the government, via a web form, about any travels that we might have undertaken. And “Quarantine for 14 days or produce a negative COVID-19 test result that has been administered up to 72-hours prior to your arrival in Massachusetts.”

From mass.gov:

72-hour Testing Rule: The individual can produce, upon request, proof of a negative test result for COVID-19 from a test administered on a sample taken no longer than 72 hours before your arrival in Massachusetts.

So we’ve spent hundreds of $billions (software, time spent with forms) for our medical records to be protected by HIPAA (federal law), but the state can demand a portion of our record via a “request” (fine of $7,000 if one fails to comply with the “request”; see the governor’s 45th order).

Plainly the Shutdown Karens can say that this is quite reasonable. The governor has declared an emergency so the state government should have access to whatever is necessary to deal more effectively with that emergency (never mind that test and trace immediately fell apart, so this information is useless, or that the typical person is not contagious by the time a test has been scheduled and result received (NYT)). But, on the other hand, a governor can declare additional “emergencies” any time that he/she/ze/they wants to. Obesity kills far more Americans than COVID-19. Couldn’t a governor declare an obesity crisis and demand that people submit medical records related to obesity and diabetes? We’re already in an opioid crisis, right? Why shouldn’t the state have the right to “request” your prescription records to make sure that you haven’t been getting too many OxyContin pills? (and fine you $7,000 if you fail to comply with the request)

Very loosely related, a conversation with a 5-year-old after putting a e-collar on our golden retriever to prevent her from scratching at a scab:

  • Me: Mindy doesn’t like wearing this collar.
  • Child: Why not?
  • Me: Even a dog can tell when her liberty is taken away.

7 thoughts on “How does HIPAA interact with state governors’ demands for COVID-19 test results?

  1. From what I understand (through a family member who is a physician in MA) the OxyContin prescriptions are being very closely watched through auditing of the doctors themselves. This is not to say it’s impossible the State could request your records to double check them.

    • Alex: That has always been true! As Edward Tufte notes in his latest book: “Every single oxycodone pill was approved by the U.S. Food and Drug Administration, and was made by licensed drug companies, prescribed by licensed doctors, sold by licensed pharmacists. All 72,000,000,000 pills (500 pills/U.S. household) were tracked to the exact place/time/amount of sale by the Drug Enforcement Agency.”

    • I’ll have to ask my relative for some clarification on that. A few years ago, when all of the opioid mess began, he treated one of my other relatives for a condition requiring minor surgery and prescribed some of them for pain. The prescription was for 16 pills, a very small amount, so we asked why? He said: “All my prescriptions for these are monitored and I don’t prescribe more than absolutely necessary, with no refills.” The prescribee didn’t mind: they’re definitely addictive and you don’t want more than you need to have. But I’ll ask him again and see if I can gain any additional insight.

    • Alex: 16 pills is a huge number by European standards! In my opinion, oxy should be delivered one at a time, e.g., with a Chinese-style courier service.

    • @Philg: You’re right and probably today he would have prescribed fewer, but this was several years ago before it became headline news and was still developing. That’s why I want to ask him, because today I think he would have been stricter.

  2. My feeling has always been that Charlie Faker has always couched his orders as “requests” because they have no itention of actually enforcing them to the extent that they will defend them in court. Haven’t seen a case, but I would imagine that they would threaten you, but if someone actaully just ignored the law and dared the Commonwealth to arrest them, they would drop it. They are counting on Maskachusetts rezidents to police themselves.

    Have i mentioned we are putting our house on the market next spring?

  3. As I understand HIPAA it does not provide for privacy from the gov’t just from other peasants.

Comments are closed.