site banner

Small-Scale Question Sunday for May 4, 2025

Do you have a dumb question that you're kind of embarrassed to ask in the main thread? Is there something you're just not sure about?

This is your opportunity to ask questions. No question too simple or too silly.

Culture war topics are accepted, and proposals for a better intro post are appreciated.

2
Jump in the discussion.

No email address required.

Is it just, like, straight-up illegal to get anonymous STD testing in Alabama?

https://law.justia.com/codes/alabama/title-22/title-1/chapter-11a/article-1/section-22-11a-14/

Any physician who diagnoses … a case of sexually transmitted disease as designated by the State Board of Health, … shall report … to the state or county health officer … the patient’s full name, date of birth, … address, telephone number, … stage of disease, … and the date of onset.

Or is there some workaround where a physician or clinic can “give you the tools for diagnosis” without being the one to diagnose you?

Lots of so-called “confidential” processes are very much not confidential or anonymous once you dig into the fine print. Never tell your psychiatrist that you’ve had suicidal thoughts unless you want to be committed.

I would be surprised if that's how it actually worked in the US.

At least in the UK, admitting suicidal ideation isn't a route to involuntary commitment by itself. I'd know, I've told my GP and psychiatrist about mine. All the cases I've seen admitted sought admission themselves, and it's only involuntary in situations such as someone found during/after a suicide attempt, and even then we can't hold them for very long. Patient autonomy counts for a lot here.

If you tell a shrink that you're having thoughts about offing yourself, they'll likely attempt to treat depression. If you tell them you've got the knife and a note ready, then that's a whole different kettle of fish.

Yep, that's my worry exactly. If a professional knows your legal name, or could easily learn it, then any so-called ““““confidentiality””” seems to just become a marketing gimmick meaning they probably won't publish you as a case study, post about it on social media, or talk about you on-the-record with medical professionals not working at the same provider.

I wrote a long comment here but I ended up deleting because their were too many edge cases and complexity but the short version is:

  1. If a healthcare facility or employee abuses your personal information in ANY.WAY. the government will absolutely anally violate anyone involved with several rusty implements. They are extremely aggressive about this to the point where it has become counterproductive and directly harms patient care (ex: nobody wants to send care-critical records to anyone for fear of being beaten with the HIPAA spoon). Exceptions exist but are for the most part extremely well validated.

  2. The above poster is not giving good advice. Having suicidal thoughts is not grounds for commitment. While some health systems are overly aggressive with commitment (so it is a real problem) tons of people are sent home from the hospital or leave their doctor's office after expressing suicidal thoughts. Something like a plan for how you would kill yourself is not the same thing.

Having suicidal thoughts and not telling your doctor or people in your life is for the obvious reasons much more dangerous to you.

If a healthcare facility or employee abuses your personal information in ANY.WAY. the government will absolutely anally violate anyone involved with several rusty implements.

"Abuse" is a matter of opinion; HIPAA means they can disclose it only with the patient's "consent".

Have you ever found a single healthcare provider whose notice of privacy practices contained no clauses which were written to include consent to share health information with an open-ended, undisclosed set of 3rd parties? Please share, if you have.

https://www.uabmedicine.org/legal/notice-of-health-information-practices/

We may use and disclose your medical information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

… We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you.

… There are some services provided in UAB Health System through contracts with business associates. Examples include a copy service we use when making copies of your health record, consultants, accountants, lawyers, medical transcriptionists, and third-party billing companies. When these services are contracted, we may disclose your health information to our business associate so that they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associate to appropriately safeguard your information.

What do you imagine happens with this information?

Research for instance requires patient direct informed consent or your data to be totally anonymized. Your privacy is protected, although someone else may benefit from having cared for you.

Some information needs to be given to your insurance for instance so they can pay, that's the primary point of boilerplate like this.

To give an example of how restricted and scary HIPAA is - you do not require patient consent to reach out to a patient's primary care doctor to gather information on the patient. This is important because most patient's struggle to remember all of their health history, their medications, the results of recent lab tests you wouldn't necessarily want to duplicate, imaging results and so on.

Despite this most systems will require patient consent to be faxed to them anyway, even in situations where the patient is say, not able to consent due to illness severity.

If health systems are willing to let quality of care be damaged how free with your information do you think they are?

Sure, a hospital, and maybe my doctor, is going to put on this big show of paranoia when it comes to disclosing my PII to each other.

But if I have definitely "legally" given them "consent" to give my PII and PHI to 3rd-parties that I'm not even able to learn the names of, what reason do I have to think that those 3rd-parties will take similar "precautions"? The only thing those 3rd-parties have to do is make sure they don't literally have my legal name in the same CSV file as any specific diagnoses when they get hacked, and I'll be none the wiser.


My workplace offers as a benefit genetic cancer screening. I thought this would be a neat thing to check out, since I'm really unsure how much of the skin and breast cancer in my extended family is just due to their shitty lifestyle. But the screening company's privacy policy did not inspire confidence, so I sent them this e-mail:

  1. How do I opt out of “Health Information Exchange” sharing?

  2. How can I know when my information is used for “Research”?

    • How can I get copies of the IRB approval?

    • If the final research paper is paywalled, are the involved patients entitled to a free copy of it? 😁

  3. I see that you share patient health information with an undeclared list of Service Providers, Medical Providers, Public Health Authorities, Other Parties, Business Partners, Affiliates, Subsidiaries, Advertising Partners, and various "API and SDK providers".

    Assuming you maintain records of this sharing, how could I request a complete account of it, including:

    • Exactly what information was shared;
    • The legal name and address of the 3rd party the information was shared with;
    • The date the information was shared;
    • The specific purposes for which the information was shared;
    • Any specific constraints on when the 3rd party must delete the information;
    • A complete list of “4th parties” the 3rd party is authorized to share my information to, including legal name and address?

The reply I got back did not address most of my questions, and only claimed that

  1. they don't actually traffick information to HIEs at this time (that was just boilerplate from the privacy policy they blindly copy-pasted from a legal document repository);
  2. all their studies are done internally at this time; and
  3. "[Our company] does not sell or share any information ... with any advertising partners. We will be updating our Privacy Policy to ensure it accurately reflects our commitment to protecting your data and maintaining our trust."

(This was 3 months ago, but their posted privacy policy still explicitly states, "We may disclose your Personal Information with advertising partners.")

Sure, a hospital, and maybe my doctor, is going to put on this big show of paranoia when it comes to disclosing my PII to each other.

I can tell you it's not a show, if I'm in an elevator talking about "John Doe" or even like Dingle McCringleberry the nursing administration gestapo are going to crawl straight up my rectum.

I suspect the rest of your stuff would be resolved if you actually talked to someone who knew what they were talking about and wasn't worried about covering their ass (for instance an HIE in this context probably refers to routine health record sharing that you want in case you are in a car accident in another city).

Granted something like 23 and Me is a different story.