Clinical Data Sharing: The HIPAA Myths That Are Costing You Millions

As of 2021, 96 percent of U.S. non-federal acute care hospitals had adopted ONC-certified health IT (ONC / HHS Report to Congress). That's the good news. The bad news? Most of them still think sharing clinical data is a HIPAA minefield that requires a lawyer's blessing for every API call. I've been in health informatics long enough to watch organizations cripple themselves with fear-based compliance. Let's bust some myths.

Does HIPAA forbid sharing clinical data with patients or other providers?

No. HIPAA sets a floor, not a ceiling. The Privacy Rule actually gives patients the right to access their own protected health information (PHI) (45 CFR 164.524). Sharing with other providers for treatment is explicitly permitted without authorization. The 21st Century Cures Act even made sharing electronic health information the expected norm (ONC / HHS). If you're hiding behind HIPAA to block data sharing, you're not being compliant—you're being obstructive.

Is all clinical data considered PHI under HIPAA?

Not necessarily. HIPAA defines PHI as individually identifiable health information transmitted or maintained in any medium, including electronic media (45 CFR 160.103). If you de-identify data according to the standards in the Privacy Rule, it's no longer PHI. But here's the catch: most clinical data—even a simple blood pressure reading—becomes PHI the moment it's tied to a name, date of birth, or medical record number. The key is de-identification done right, not assuming a few fields removed makes it safe.

Does the HIPAA Security Rule require encryption for all ePHI?

No, but it requires you to address it. The Security Rule's technical safeguards include encryption as an addressable implementation specification, not a required one (45 CFR 164.312). 'Addressable' means you must assess whether it's reasonable and appropriate—and if not, implement an equivalent alternative. In practice, I've never seen a defensible reason not to encrypt at rest and in transit. NIST SP 800-66, the official HIPAA Security Rule implementation guide, strongly encourages encryption as a best practice (NIST SP 800-66). So while the rule technically gives you wiggle room, don't use it.

Is it true that sharing data with a business associate always requires a BAA?

Yes, if they're a true business associate. Under HIPAA, a business associate is someone who creates, receives, maintains, or transmits PHI on behalf of a covered entity for a regulated function like claims processing (45 CFR 160.103). If you're sending clinical data to a lab, a cloud vendor, or a health information exchange, you need a BAA. But here's the myth: some organizations think a BAA transfers all liability. It doesn't. The covered entity remains responsible for the actions of its business associates. A BAA is a contract, not a shield.

Does the HIPAA Breach Notification Rule force you to report every unauthorized access?

No. The Breach Notification Rule requires notification only for 'unsecured' PHI—that is, PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction (45 CFR 164.402). If your data is encrypted and the key isn't compromised, you may not have a breach at all. But if you lose an unencrypted laptop with 500 patient records, you have 60 calendar days to notify each affected individual (45 CFR 164.404). That's a tight deadline. The best way to avoid breach notification is to encrypt everything so a loss doesn't become a reportable event.

Is sharing clinical data for research prohibited without patient authorization?

Not always. The Privacy Rule allows research on PHI without individual authorization under certain conditions, such as a waiver approved by an Institutional Review Board (IRB) (45 CFR 164.512(i)). But here's the myth I hear constantly: 'We can share de-identified data without any oversight.' De-identified data is not PHI, so HIPAA doesn't apply. But if your de-identification is weak—say, you keep ZIP codes and birth dates—that's not truly de-identified. The minimum necessary standard (45 CFR 164.502(b)) applies to routine disclosures, but for research, you need a solid plan, not a hand-wave.

Does HIPAA require you to use FHIR for interoperability?

No. HIPAA doesn't mandate any particular standard. But the Cures Act and ONC's information blocking rules push you toward modern APIs. FHIR is HL7's modern standard using RESTful APIs (HL7 International). FHIR R5 defines 157 resources (HL7 FHIR Resource Index), and the US Core Implementation Guide, based on FHIR R4, is the foundation for US interoperability (US Core IG). If you're still building interfaces on HL7 Version 2—which was first published in 1987—you're not violating HIPAA, but you're missing the boat. FHIR is the direction of travel.

Is the ONC information blocking rule a HIPAA violation if you don't comply?

No, it's separate. The information blocking rule applies to healthcare providers, health IT developers, and health information exchanges (ONC / HHS). It went into effect April 5, 2021, and before October 6, 2022, it applied only to USCDI data elements (ONC / HHS FAQ). If you're a provider and you refuse to share electronic health information with a patient's app, you could face penalties from HHS OIG—not under HIPAA, but under the Cures Act. So don't confuse the two. HIPAA gives you the floor; the Cures Act pushes you to share more.

What I'd actually do

Here's my concrete recommendation: Stop treating HIPAA as an excuse for data hoarding. Instead, do three things. First, encrypt all ePHI at rest and in transit—period. That alone eliminates most breach notification headaches. Second, adopt FHIR for all new interfaces, starting with the US Core profiles, because that's where the industry is going (US Core IG). Third, review your information blocking compliance and make sure your EHR's patient portal API is actually working—not just available but usable. The penalty for non-compliance can be steep: HHS raised the HIPAA annual cap to $2,190,294 (Federal Register, 91 FR 3665). But the real cost is the trust you lose when you make it hard for patients to get their own data. I'd rather invest in secure, open sharing than in lawyers who tell me what I can't do.

Sources

• ONC / HHS (Report to Congress) - https://healthit.gov/news/onc-outlines-health-it-interoperability-progress-report-congress/
• eCFR 45 CFR Part 160 (HIPAA Definitions) - https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160
• eCFR 45 CFR Part 164 Subpart D (Breach Notification) - https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D
• ONC / HHS (Information Blocking) - https://www.healthit.gov/topic/information-blocking
• HL7 FHIR (Resource Index) - https://www.hl7.org/fhir/resourcelist.html
• US Core Implementation Guide - https://hl7.org/fhir/us/core/