How HIPAA Really Happens in Business


In my prior two commentaries on the legalities and ethics of medical writing I tried to differentiate medical professional writings from journalistic medical writings.    The former is what we see in professional journals, especially those which are refereed (pre-read and approved by colleagues), the latter is common to everything from the internet to corporate catalogues, company news releases, and even trade and popular press magazines, with content that is often controversial (Friedman & Lee, 2013, Reamer 2013, Banning 2014).

In my own recent work environment, a research venture involving four researchers, two of whom were writers and one mostly a businessman in healthcare, demonstrated to me how differentiating the definition of who “discovered” something a very interesting experience.

From my point of view, I am personally responsible for most of the mathematical queries used to draw final conclusions.  One might even argue that the paths I take and the conclusions I draw are the only primary findings of this research project.  But this is not the way research is in the corporate world.

This project I engaged in actually exists at several levels.  First it was in the mind of my manager, who shared it with his Director, who then shared it with the Chief Operations Officer (COO).  Their desire was for me to define how to produce an outcome related to an undefined research question.  This project and the results of its conclusions however didn’t just materialize over night.  The first rendering was conceptualized by my manager, its application to the field verified by his Director, making my job the need explore this part of the medical world and then see if any unique findings can be made.  The last goal was to satisfy the Officer, the source for all outside support and the primary news outlet for this work.

Not unexpectedly, by the time my “findings” were turned into a report, much of the nature of this project had changed.  Its “official” purpose was finally defined, the key findings understood, and even some of the underlying science of its meaning made clearer to the COO.  These events, along with the up and coming presentation of results in just a few weeks defined the overall hierarchy of this research and the role of its presenters, which was as follows: principal investigator, chief presenter, second presenter, statistician, and officer.

Important to note however is the unique nature of how the business world managed its scientific correctness and legal requirements.  The manager-director engage in their own forms of communication for this study (text messaging), receiving the appropriate internal review board (IRB) outcomes needed to advance this news to the COO (Karasz, Eiden, & Bogan, 2013).  The COO, residing outside this work environment, also has an IRB requirement.  Both of these IRBs required significant reviews of how the original data I worked with was transmitted, how the personal health information (PHI) was attended to, and how the data were transformed into aggregate information with no possibility for identification of individuals (HIPAA compliance) (Landa & Elliott, 2013, Tomes, 2013).  Citations were evaluated for appropriateness, location and format for each one’s initial citing.   These steps enable the “discovery” made to be kept clear of other findings leading up to a final review that is also ethical and HIPAA compliant (Shamoo & Resnik, 2009; Horner & Minifie, 2011), but  in the business world sense (Tomes, 2013).

In the end, the true discoverer of all of this depends upon conclusions drawn by the readers (Sismondo 2013).  Even then, these are very much a subjective (even biased) conclusions that are often drawn in such writings.

So, is there an answer to my important question : who made the primary discovery in this case?  Perhaps not.

Was it the COO, Director and Manager, or statistician?



Banning, S. (2014). Not Quite Professional. Journalism History, 40(1), 28-39.

Friedman, A., & Lee, C. (2013). Producing Knowledge about Racial Differences: Tracing Scientists’ Use of “Race” and “Ethnicity” from Grants to Articles. Journal of Law, Medicine & Ethics, 41(3), 720-732.

Horner, J. Minifie, F.D.  (2011)  Research Ethics III: Publication Practices and Authorship, Conflicts of Interest and Research Misconduct. Journal of Speech Language and Hearing Research, 54, S346-S362.

Karasz, H. N., Eiden, A., & Bogan, S. (2013). Text Messaging to Communicate With Public Health Audiences: How the HIPAA Security Rule Affects Practice. American Journal of Public Health, 103(4), 617-622. doi:10.2105/10AJPH.2012.300999

Landa, A., & Elliott, C. (2013). From Community to Commodity: The Ethics of Pharma-Funded Social Networking Sites for Physicians. Journal of Law, Medicine & Ethics, 41(3), 673-679.

Reamer, F. (2013). Social Work in a Digital Age: Ethical and Risk Management Challenges. Social Work, 58(2), 163-172.

Shamoo, A. E., Resnik, D. B.  (2009).  Responsible Conduct of Research. 2ed.  New York: Oxford University Press.

Sismondo, S. (2013). Key Opinion Leaders and the Corruption of Medical Knowledge: What the Sunshine Act Will and Won’t Cast Light On. Journal of Law, Medicine & Ethics, 41(3), 635-643.

Tomes, J. P. (2013). The Law of Unintended (Financial) Consequences: The Expansion of HIPAA Business Associate Liability. Journal Of Health Care Finance, 39(4), 28-35.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s