States Selling Health Records Might Risk Patient Privacy

States could be putting patients' privacy at risk by selling medical records that could be used to link an individual's identity to their medical conditions. Although the Safe Harbor HIPAA provision requires that shared data have 18 key identifiers -- such as age, ZIP code or hospital admission and discharge dates -- removed, state agencies are exempt from HIPAA rules. According to records reviewed by Bloomberg and Harvard University researchers, 26 states release some combination of the key identifiers when they sell medical records.

• "States' Hospital Data for Sale Puts Privacy in Jeopardy" (Robertson, Bloomberg, 6/5).