Not long after I started working in television news, I encountered a strange term.
HIPAA.
This acronym might sound like something you’d see at the zoo. But it actually stands for the Health Insurance Portability and Accountability Act.
HIPAA protects personally identifiable health information. And as a news producer, HIPAA meant that health records were a no-fly zone for me.
If someone was injured in an accident or crime that made my newscast, I couldn’t give any updates on their status.
I couldn’t do this because I didn’t have access to the victim’s health records. Those were protected from journalists like me by the regulation.
I accepted this.
For I recognized there was a good reason for HIPAA. And I figured that the regulation would fend off other entities looking to access sensitive information as well.
So, imagine my surprise when I learned recently that Google has access to these classified records.
It’s true. Google has been partnering with a healthcare network called Ascension to gather the personal health information of millions of people.
The partnership has been dubbed Project Nightengale. And unlike other health data sharing agreements, the information Google has been receiving from Ascension has not been anonymized. That means patients’ names and dates of birth are present in the data set.
While I left the news industry long before this story broke, I was still rankled by it.
That’s illegal, I thought. That arrangement violates HIPAA.
But I was wrong.
Since Google is considered a business associate of Ascension, the tech giant is in the clear. HIPAA specifically allows health providers to pass data to third parties in order to improve patient care. And, lo and behold, that was the stated objective of Project Nightengale.
Of course, the cynics among us — myself included — see right through this façade. We can point to Google’s traditional intentions — profit through advertising revenue — and start musing about how the company might cash in off our most sensitive data.
It’s an upsetting thought. But not one without merit.
And there’s not much we can do about it.
There is no chance that lawmakers had an arrangement like Google’s in mind when they drafted HIPAA in 1996.
After all, Google hadn’t even been founded yet. And the Internet consisted mostly of America Online CDs and those iconic dial-up connection tones.
But even if legislators could have seen this nascent issue brewing, they likely couldn’t have done much to prevent it.
For Google has taken a deft approach to entering the healthcare market. The Silicon Valley behemoth has leveraged its advantages in data management to secure the Project Nightengale partnership. And it has done all this in the name of improving the healthcare process.
These types of opportunities are within the bounds of HIPAA. This is a main reason why Project Nightengale was allowed to proceed.
But Google’s true intentions as a company — growth in advertising opportunities, revenue and profit — run counter to the entire act.
HIPAA was specifically designed to keep marketers, advertisers and salespeople from exploiting our sensitive health information. But Google now has open access to just that.
In other words, Project Nightengale is a Trojan Horse. It’s allowed the fox into the henhouse.
The Project Nightengale loophole is a prime example of a broad interpretation of a regulation.
Broad interpretations encourage free enterprise. They provide ample opportunities for people and companies explore and create. But that’s not always a good thing.
Indeed, many use a broad interpretation of a law to meet prioritize their own needs and objectives. They sidestep the spirit of a rule for their own selfish gain.
This might sound excessively sinister. But it proves itself true, time and again.
Consider the Rooney Rule, for instance.
This regulation states that whenever there’s a head coach opening in the National Football League, the team must interview a minority candidate as part of the hiring process.
The Rooney Rule was designed with the best of intentions — to get more African-American and Hispanic coaches a chance to get a head coaching gig. But in practice, it rarely works as intended.
These days, many NFL teams simply go through token interviews with minority candidates. They have little intention on following through with a job offer, as they already have their sights set on a different coach. One who’s older, more experienced — and whiter.
So, they do the interview with the minority candidate, and quickly move on.
This practice technically complies with the Rooney Rule. But it pierces a dagger through the spirit of it.
Minority candidates are still not given a fair shake. If anything, they’re being further exploited.
On the other side of the spectrum lies the narrow interpretation.
This is the literal expression of the rule. The letter of the law. The words on the page without any added context.
If the broad interpretation is easy to exploit, the narrow interpretation is quite the opposite. For the words on the page are as restrictive as they are unambiguous.
Think of the Ten Commandments. And all the Thou Shalt Nots.
Thou shalt not murder. Thou shalt not steal. Thou shalt not bear false witness against your neighbor.
Whether we’re secular or not, we take the narrow interpretation on these edicts as a society.
There is no wiggle room. We can’t keep in the spirit of the rule while we flaunt it. Murder, theft and lying are all forbidden acts. We must avoid them or face harsh consequences.
Over the years, many have embraced the narrow interpretation. Religious zealots have pounded the Bible. Conservative politicians have wrapped themselves in the Constitution. And exacting supervisors have demanded adherence to the employee handbook.
It’s easy to see why this view has such a draw. It provides authoritative clarity in a world that’s all too often murky and gray.
But don’t be fooled. The narrow interpretation is no panacea.
Some of the great Supreme Court justices have relied on the narrow interpretation. But so have some of the most legendary mobsters.
Indeed, our obsession with by-the-book justice helped gangsters like Al Capone and Whitey Bulger become notorious.
Sure, under the narrow interpretation, Capone and Bulger would be considered rule breakers. In theory, they would be castigated as murderers, thieves and liars.
But Capone and Bulger did much of their bidding through associates. Through coded instructions and well-defined syndicates.
And under United States law, that made them nearly impossible to catch.
Yes, federal law enforcement officials went after them. But their hands were tied by the narrow interpretation of two words from the Constitution: Probable cause.
These two words made it difficult for the feds to get search warrants or arrest warrants. These two words effectively prolonged the reigns of terror of Capone and Bulger.
This is the problem with the narrow interpretation. It doesn’t adapt with the times. And because of that, it can be easily short-circuited.
It can keep us from killing each other. Unless our name is Al Capone.
So, which path should we allow to guide us? The narrow one or the broad one?
It’s hard to say.
Each has its benefits. But each has its drawbacks.
When I think of my sensitive health information in Google’s hands, I wish that the interpretation of HIPAA was narrower. I wish that I still had the final sign-off for sharing information about my own body.
But when I think of all the criminals who evade justice on a technicality, I wish the interpretation of the law was broader. I wish there wasn’t free license for mobsters and corruption to run unchecked.
With this in mind, it’s probably best to follow a hybrid interpretation. To go narrow when enforcing specific guidelines designed to protect us. And to go broad when enforcing the more general ones.
Going hybrid would require us to completely overhaul our approach.
Instead of focusing on the regulation itself, we would need to focus on the effect. On what activity the rule is prohibiting. And who would be harmed by that activity if it was allowed to remain unchecked.
This would take more due diligence. And it would open the door to more ambiguity.
But these inconveniences would be worth it.
For rules and regulations are more than text on a page. When drafted well, they serve as signals of intent to protect us.
It’s about time we honor that spirit. And govern ourselves accordingly.