'Julie' learns that privacy is more illusion than reality

Readers here yesterday will recall the first half of the story of Julie, the pseudonym of a Boston-area lawyer who spoke at a healthcare privacy conference in Washington this month.

Julie said she began psychotherapy sessions in 2002. At the time, she was assured records of those sessions would be kept private.

But Julie said she learned in 2008 that a primary-care physician she was seeing for a stomachache had read notes from her years of psychotherapy.

Here's the rest of her story:

Julie said she first appealed to authorities at the big-name healthcare organization where she received care, seeking what she thought would be a quick fix: segregation of her therapist's notes from the rest of her records.

"There is supposed to be protection for what's called psychotherapy notes," she said. "Those are not allowed to be in the record."

Instead, someone at the big-name healthcare organization blithely told her it had "interpreted that what was in my record were not psychotherapy notes; those were psychiatric records. They said they were not going to segregate psychiatric records. It's a disservice to their patients."


"Here, they're releasing the records against my consent," Julie said. That set her "on a writing binge."

Julie said she wrote to the big-name organization, formally requesting a copy of all her medical records. Three months later the records came by mail "in a horrible envelope,"—376 pages, mostly therapy notes.

"It was everything—problems with my family, me not talking to my mother, my (being victimized by) sexual abuse, my financial situation, everything," she said.

Julie also wrote to the state and to the Office for Civil Rights at HHS, the chief federal healthcare privacy enforcer under the Health Insurance Portability and Accountability Act.

OCR's response?

No investigation.

"Even if I were to prove they were psychotherapy notes," Julie said she was told, "that wouldn't violate the privacy rules, and every covered entity could make up their own mind about what they put in their records, even if it is psychotherapy notes. It's not up to the patient."

Months later, someone at the big-name healthcare organization honored her request to restrict her old psychotherapy notes but told her any new notes would be accessible to other providers. If she didn't like it, she could seek care elsewhere.

"Nobody told me their privacy rule had changed," Julie said. "I still thought they needed my authorization. I had no idea this had happened."

Don't feel bad, Julie.

Few Americans know that HIPAA is now just rouge on a pig.

The change came in 2002, after many big-name organizations that wanted to make money off patient information or not to be bothered obtaining patient consent lobbied HHS and had patient consent nullified.

Today, providers large or small can ignore any patient's plea for privacy, like Julie's—or honor it, like Julie's—or do both, like Julie's.

Good luck, Julie, in finding your new doctor who can and will protect your privacy.

Diogenes had better odds.

Follow Joseph Conn on Twitter: @MHJConn.



Loading Comments Loading comments...