Also from the article:
“But privacy experts said it appeared to be permissible under federal law. That law, the Health Insurance Portability and Accountability Act of 1996, generally allows hospitals to share data with business partners without telling patients, as long as the information is used ‘only to help the covered entity carry out its health care functions.’”
That’s the huge loophole in HIPAA and pretty much makes anything permissible as long as those functions can be demonstrated.
Still only true if personal identification information is removed.
We are allowed to get med device data from the hospitals by agreement to monitor and improve equipment, but it must have the personal information stripped and if it is not it must immediately be reported and deleted. Not sure the final end steps on the back end, but I think the patient ends up getting informed of the breach.