<story><title>My Doctor&apos;s Office Asked me to Lie (2011)</title><url>http://stallman.org/articles/asked_to_lie.html</url></story><parent_chain><item><author>shmageggy</author><text>So are you saying that in order to comply, the office needs to furnish every patient with a 3000 page binder of privacy practices and that systematic failure to do so should mean over a million dollars in fines? I really hope I&amp;#x27;m misunderstanding something because this seems insane.</text></item><item><author>haldujai</author><text>IANAL but I&amp;#x27;m responsible for HIPAA compliance in my startup:&lt;p&gt;Assuming this is a standard private practice, this office has several violations of 45 CFR §164.520(a)(b)(c), assuming that he was also not provided this privacy statement within 30 days with a reason for why it was not provided on the first visit.&lt;p&gt;This makes them liable for $50,000 in fines per failure to a max of $1.5 mm (this would be a clear cut case of reckless indifference.) The DHHS OCR is always looking for some head to serve on a platter to justify themselves as well.&lt;p&gt;His amendment to the form is damning evidence and that receptionist should be fired, there is no excuse for basic HIPAA noncompliance in 2011 (8 years after the fact).&lt;p&gt;Edit: What some people don&amp;#x27;t seem to understand is that signing the privacy practices notice (the form in question here) &lt;i&gt;does not&lt;/i&gt; mean you agree to the terms and conditions outlined. You only sign that you have &lt;i&gt;received&lt;/i&gt; them. Additionally, whether you sign the form or not it applies to you, and whatever that form states HIPAA clearly outlines what powers the covered entity (the doctor in this case) has over your information.</text></item></parent_chain><comment><author>smacktoward</author><text>The only reason to believe the privacy statement is 3,000 pages long is because the receptionist said it was, and given the rest of her statements there&amp;#x27;s little reason to believe she knew what she was talking about. She may have just made up a large number to try and scare him off from inquiring further.&lt;p&gt;I&amp;#x27;ve been given privacy statements from my doctors&amp;#x27; offices in the past, and they&amp;#x27;ve never been more than a couple of pages.</text></comment>
<story><title>My Doctor&apos;s Office Asked me to Lie (2011)</title><url>http://stallman.org/articles/asked_to_lie.html</url></story><parent_chain><item><author>shmageggy</author><text>So are you saying that in order to comply, the office needs to furnish every patient with a 3000 page binder of privacy practices and that systematic failure to do so should mean over a million dollars in fines? I really hope I&amp;#x27;m misunderstanding something because this seems insane.</text></item><item><author>haldujai</author><text>IANAL but I&amp;#x27;m responsible for HIPAA compliance in my startup:&lt;p&gt;Assuming this is a standard private practice, this office has several violations of 45 CFR §164.520(a)(b)(c), assuming that he was also not provided this privacy statement within 30 days with a reason for why it was not provided on the first visit.&lt;p&gt;This makes them liable for $50,000 in fines per failure to a max of $1.5 mm (this would be a clear cut case of reckless indifference.) The DHHS OCR is always looking for some head to serve on a platter to justify themselves as well.&lt;p&gt;His amendment to the form is damning evidence and that receptionist should be fired, there is no excuse for basic HIPAA noncompliance in 2011 (8 years after the fact).&lt;p&gt;Edit: What some people don&amp;#x27;t seem to understand is that signing the privacy practices notice (the form in question here) &lt;i&gt;does not&lt;/i&gt; mean you agree to the terms and conditions outlined. You only sign that you have &lt;i&gt;received&lt;/i&gt; them. Additionally, whether you sign the form or not it applies to you, and whatever that form states HIPAA clearly outlines what powers the covered entity (the doctor in this case) has over your information.</text></item></parent_chain><comment><author>haldujai</author><text>Notices of privacy practices for practices are a boilerplate form that shouldn&amp;#x27;t be more than 10 pages long. Whatever they write is meaningless if it gives them more power than the law does, most places just use the AMA or state agency recommended forms.&lt;p&gt;The law actually states what needs&amp;#x2F;should be written.&lt;p&gt;Here is an example [doc file]: www.ama-assn.org&amp;#x2F;resources&amp;#x2F;doc&amp;#x2F;hipaa&amp;#x2F;privacy-practices.doc‎&lt;p&gt;That said, places with their own websites need only upload the form and tell patients it is able to be viewed at at whatever link and have the binder accessible in the office for viewing.&lt;p&gt;Uploading to dropbox&amp;#x2F;filesharing without a website is not a valid option.</text></comment>