I am not a "covered entity" under the federal law that includes protections for the privacy of healthcare information. UHC IS covered under HIPAA. That means that UHC has some rules that they have to follow to protect healthcare information.
It seems like there is a bit of a dilemma here. Since I am not covered by HIPAA, this information is not "private" when it reaches me. Since UHC IS covered under HIPAA, the same information is likely "private" when the effort is made to communicate it to UHC.
So, how did this information lose its privacy?
Can you blame hundreds of telephone callers, all of whom are coincidentally dialing the same wrong number? Does it matter that they stop dialing that wrong number when UHC's website changes?
When UHC made a change to their website, ALL of the calls ceased. I let UHC know that the calls stopped, by posting in this blog. They changed the website back and the calls resumed.
If you blame UHC's website, with changes that correlate to stopping and starting the flow of calls, it would seem that UHC is responsible for sending callers to the wrong place to deliver their information.
If you say that it is mere coincidence that over 300 people have all called my home, then you have to blame each one of the 300+ callers individually. If you blame each caller for calling a wrong number, then the information never touches UHC, and it is therefore not health information.
Wonder if UHC would say that this information somehow "belongs" to them, or is "private?" If they do, aren't they inserting themselves, and/or their website, into the connection between the callers and my home? Wouldn't that make them responsible?
How would this be different from a hospital fax machine that sends records to a car repair shop? The hospital sets the fax machine speed dial number wrong, and employees innocently use the wrong number and transmit information.
In this instance, it seems like UHC has configured their advertising in a confusing manner, and callers may similarly use the wrong number and transmit information. It might have been an innocent failure to consider their audience when setting up their listings, but since I've told UHC about it (repeatedly), they KNOW it is happening.
I think that this question is one that requires greater expertise than I possess. I have contacted the Office of Civil Rights and requested clarification on this situation. I've already received an acknowledgment and am optimistic that they will be able to help. The OCR provides guidance and enforcement on HIPAA.
Perhaps the OCR will help UHC know how to proceed. If these hundreds of calls represent the hospital's "private" information, I hope they will stop sending the calls to me.
I suspect that UHC will take the position that they have nothing to do with these calls, and that the information is NOT "private" information. I am hopeful that the Office of Civil Rights will be able to inform both UHC and me on this issue.