The Anatomy of the HIPAA Privacy Rule: A Risk-Based Approach as a Remedy for Privacy-Preserving Data Sharing

Abstract

This paper explores the effectiveness of a risk-based approach methodology in constructing systematic standards for privacy-conscious data sharing and disclosure. We consider the HIPAA (Health Insurance Portability and Accountability Act of 1996) Privacy Rule as an example and show that the data disclosure methods defined in the HIPAA Privacy Rule are well-constituted, by assessing the privacy risks of each disclosure method. We further explore factors that contribute to the success of the HIPAA Privacy Rule and discuss how we can leverage these factors as a reference for constructing privacy-conscious and systematic data disclosure rules and regulations in other domains.