The existence of HIPAA has little to do with whether you have to take your records across doctors.

HIPAA requires that our medical data is secured when stored at a medical facility, but I still have to drive over with CDs and printed X rays if I have to go to different doctors and specialists. Doctor's referrals are still paper printouts, and you have to show up early to any doctor as a new patient, and fill out the same form about your medical history all over again. Things are still faxed, sometimes emailed.

This problem is still completely unsolved in the US. The closest thing is maybe if you're going across doctors in one hospital or hospital network, then your records are electronically "transferred"

EPIC (one of the, if not the biggest EMR providers in the US) had to be sued into not charging fees per export provider, per export, of medical records out of EPIC (on top of the 7+ digit licensing costs of EPIC itself).

> The existence of HIPAA has little to do with whether you have to take your records across doctors.

Well, actually HIPAA stands for "Health Insurance Portability and Accountability Act" - it's specifically about making health records portable.

The security provisions were it's more minor, yet, best know part.

> Well, actually HIPAA stands for "Health Insurance Portability and Accountability Act" - it's specifically about making health records portable.

No, it's about making health insurance portable. [0] (The Security and Privacy pieces—as well as the IT standards bits—are part of the one “accountability” piece of the title, and largely irrelevant to the “portability” piece.)

Health records, in terms of interoperability, weren't a big focus in the legislation (they became a bigger focus with meaningful use and related rules in the ACA.)

EDIT: to be fair, though, access to your own records is also part of the accountability part, which isn't exactly portability of records, but it's related.

[0] See, e.g , http://www.investopedia.com/terms/p/portability.asp

Interesting. Yet we see basically zero portability. So what happened?

There are electronic prescriptions as well.

There's mostly no centralized system in the US here either. I had to get an MRI on a burned CDR from my old doctor's office and walk it over to my new doctor's office three weeks ago here in NYC. None of my doctors share records with each other except when they're in the same hospital's network. And even then it can be iffy.

Unless I'm missing something, I don't see how HIPPA would have anything to do with this. It only applies to "covered entities", so had the initial disclosure happened in the US, the leaker most likely would have been implicated, but HIPPA would not apply to Uber people (unless, for some reason, Uber is a covered entity).

Defamation, sure.

I think it must be true that HIPAA doesn't apply to the Indian records, because otherwise I'm sure there would be a HIPAA complaint. Usually that would start against the professionals in the medical field that mishandled the records. Instead, this suit is about invasion of privacy and defamation. Honestly I'm surprised that she can go after them for defamation after already accepting a settlement from them. Still, these guys are obviously first-class assholes and at this point I'm not surprised anymore. Uber seems destined for the textbooks, under "how to kill a unicorn."

just settling a rape case does not give Uber execs the freedom to pass the private health records within the company and defame that woman so she is still entitled to file the defamation case. I'm surprised that you're surprised.

> pass the private health records within the company and defame that woman

Where did you get that impression the closet I could find in the article was

>speculating that Plaintiff had made up the brutal rape in collusion with a rival of Uber in India to undermine Uber's business

I'm no fan of uber but the allegations made by the plaintiff do not even amount to your description of them

Any style of regulation is non existent