I see. So if three patients visit three separate physicians (with three separate healthcare systems) with the same illness (outbreak), these records may be aggregated to detect the outbreak? I was under the impression this kind of thing was not possible, or very difficult / limited, and would require some kind of patient authorization, and that HIPAA played a role in this.

(I expect this exists for known serious things like Ebola, but was thinking more directly about things like strep or typical viruses in a school. It seems like the outbreak information is put together after the fact, or after it gets grossly bad)

> For some reason, people who are deeply ignorant about what the law actually does also seem to get the acronym wrong.

Probably that HIPPA reads more like a word than HIPAA.