Yeah..... I've kinda been dreading the day when they attempt to modify HIPAA to allow the automation of the authorization process for work places to access your medical data.

Right now as a provider if a workplace requests medical records for one of my patients I get to decide if they have authorization, a valid reason to make the request, and get to determine what information they have access to that is pertinent to their request.

I have a sneaking suspicion that with the spread of EMR systems like Epic, employers will attempt to pressure legislators to change HIPAA to automate the process and cut providers out of the picture.

The problem is that electronic medical records programs like Epic are still really shit about how they allocate things like diagnosis codes. There doesn't seem to be a good way to differentiate primary diagnosis codes made by a PCP and the diagnosis codes used for billing and documenting follow up care. It forces you to enter diagnosis codes anytime you enter a medical note, even if you don't have the proper licensing to make a diagnosis. So when someone like a nurse is documenting their care, they may just add miscellaneous diagnosis code just so they can enter their documentation.

Now any human who works in healthcare and has used Epic can read through the note and from context understand that it's a throw away miscellaneous dx code, but something like AI may just use that dx code as justification to widen the scope of their access.