INHE 3004 Week 9 Privacy Policy Critique Example

Answering the Legal Question and Missing the Ethical One: A Critique of a Cash-Pay Wellness Center's Privacy Policy That Says HIPAA Does Not Apply

Student Name

Walden University

INHE 3004: Legal and Ethical Issues in Integrative Health Care

Instructor Name

Month Day, Year

Answering the Legal Question and Missing the Ethical One: A Critique of a Cash-Pay Wellness Center's Privacy Policy That Says HIPAA Does Not Apply

The Policy

A composite cash-pay wellness center offering acupuncture, massage and nutrition coaching publishes a privacy policy with two key sentences. The first states: "Because we do not bill insurance, we are not subject to HIPAA." The second states that intake information, including health history, may be shared with "trusted partners," and a later clause names a marketing vendor that uses it to "personalize offers." This critique asks what the policy gets right, what it omits and why the omissions matter.

What the Policy Gets Right

The first sentence may well be accurate. Only covered entities fall under the HIPAA Privacy Rule, and a health care provider counts as one when it transmits health information electronically in connection with certain standard transactions, such as billing a health plan (45 C.F.R. § 160.103). A provider that takes only cash and never conducts those transactions electronically may fall outside the definition. The center's legal advisers may have been right to say HIPAA does not reach it.

What the Policy Omits

The policy treats the HIPAA question as if it settled the privacy question, and it does not. Three omissions stand out.

First, other law still applies. The Federal Trade Commission treats sharing consumers' health information for advertising, contrary to what consumers were told, as an unfair or deceptive practice. In 2023 it finalized an order against the online counseling service BetterHelp, which had shared consumers' health information with advertising platforms after promising to keep it private; the order required payment of $7.8 million and banned the company from sharing health information for advertising (Federal Trade Commission [FTC], 2023). A center that is not a HIPAA covered entity is still subject to the FTC Act.

Second, the policy does not say what "trusted partners" receive or how clients can refuse. A client reading it cannot tell whether their health history goes to the marketing vendor, in what form, or whether they can opt out.

Third, the policy never addresses what clients expect. People who describe their health history to a practitioner generally expect it to stay within their care, whether or not a federal rule says so.

The Ethical Gap

Confidentiality in health care rests on more than law. Clients disclose sensitive information because they trust it will be used for their care, and that trust is part of what makes care possible. Ethical accounts of confidentiality treat a practitioner's duty to protect such information as grounded in respect for persons and in the trust the relationship depends on, not only in statute (Beauchamp & Childress, 2019). A policy that shares intake histories with a marketing vendor, under a vague phrase, uses clients' trust for a purpose they did not agree to, even if no law forbids it.

Recommendation

The center should keep its accurate statement about HIPAA but add plain-language answers to three questions: what information is shared, with whom, and how a client can refuse. Better still, it should stop sharing health histories for marketing entirely, since the ethical cost far exceeds any marketing benefit.

References

Beauchamp, T. L., & Childress, J. F. (2019). Principles of biomedical ethics (8th ed.). Oxford University Press.

Definitions, 45 C.F.R. § 160.103 (2024).

Federal Trade Commission. (2023). FTC to ban BetterHelp from revealing consumers' data, including sensitive mental health information, to Facebook and others for targeted advertising. https://www.ftc.gov/news-events/news/press-releases/2023/03/ftc-ban-betterhelp-revealing-consumers-data-including-sensitive-mental-health-information-facebook