united kingdom the national health service is increasingly using electronic health records, but until recently, the records held by individual nhs organisations, such as general practitioners, nhs trusts, dentists and pharmacies, were not linked. each organization was responsible for the protection of patient data it collected. the care.data programme, which proposed to extract anonymised data from gp surgeries into a central database, aroused considerable opposition. in 2003, the nhs made moves to create a centralized electronic registry of medical records. the system is protected by the uk's government gateway, which was built by microsoft. this program is known as the electronic records development and the implementation programme (erdip). the nhs national program for it was criticized for its lack of security and lack of patient privacy. it was one of the projects that caused the information commissioner to warn about the danger of the country "sleepwalking" into a surveillance society. pressure groups opposed to id cards also campaigned against the centralized registry. newspapers feature stories about lost computers and memory sticks but a more common and longstanding problem is about staff accessing records that they have no right to see. it has always been possible for staff to look at paper records, and in most cases, there is no track of record. therefore, electronic records make it possible to keep track of who has accessed which records. nhs wales has created the national intelligent integrated audit system which provides "a range of automatically generated reports, designed to meet the needs of our local health boards and trusts, instantly identifying any potential issues when access has not been legitimate". maxwell stanley consulting will use a system called patient data protect (powered by vigilancepro) which can spot patterns – such as whether someone is accessing data about their relatives or colleagues. united states since 1974, numerous federal laws have been passed in the united states to specify the privacy rights and protections of patients, physicians, and other covered entities to medical data. many states have passed its own laws to try and better protect the medical privacy of their citizens. an important national law regarding medical privacy is the health insurance portability and accountability act of 1996 (hipaa), yet there are many controversies regarding the protection rights of the law. health insurance portability and accountability act of 1996 (hipaa) main article: health insurance portability and accountability act the most comprehensive law passed is the health insurance portability and accountability act of 1996 (hipaa), which was later revised after the final omnibus rule in 2013. hipaa provides a federal minimum standard for medical privacy, sets standards for uses and disclosures of protected health information (phi), and provides civil and criminal penalties for violations. prior to hipaa, only certain groups of people were protected under medical laws such as individuals with hiv or those who received medicare aid. hipaa provides protection of health information and supplements additional state and federal laws; yet it should be understood that the law's goal is to balance public health benefits, safety, and research while protecting the medical information of individuals. yet many times, privacy is compromised for the benefits of the research and public health. according to hipaa, the covered entities that must follow the law's set mandates are health plans, health care clearinghouses, and health care providers that electronically transmit phi. business associates of these covered entities are also subject to hipaa's rules and regulations. in 2008, congress passed the genetic information nondiscrimination act of 2008 (gina), which aimed to prohibit genetic discrimination for individuals seeking health insurance and employment. the law also included a provision which mandated that genetic information held by employers be maintained in a separate file and prohibited disclosure of genetic information except in limited circumstances. in 2013, after gina was passed, the hipaa omnibus rule amended hipaa regulations to include genetic information in the definition of protected health information (phi). this rule also expanded hipaa by broadening the definition of business associates to include any entity that sends or accesses phi such as health it vendors. controversies the health insurance portability and accountability act (hipaa) is critiqued for not providing strong medical privacy protections as it only provides regulations that disclose certain information. the government authorizes the access of an individual's health information for “treatment, payment, and health care options without patient consent”. additionally, hipaa rules are very broad and do not protect an individual from unknown privacy threats. additionally, a patient would not be able to identify the reason for breach due to inconsistent requirements. because of limited confidentiality, hipaa facilitates the sharing of medical information as there is little limitation from different organizations. information can easily be exchanged between medical institutions and other non-medical institutions because of the little regulation of hipaa - some effects include job loss due to credit score sharing or loss of insurance. additionally, doctors are not required to keep patients information confidential because in many cases patient consent is now optional. patients are often unaware of the lack of privacy they have as medical processes and forms do not explicitly state the extent of how protected they are. physicians believe that overall, hipaa will cause unethical and non-professional mandates that can affect a person's privacy and therefore, they in response have to provide warnings about their privacy concerns. because physicians are not able to ensure a person's privacy, there is a higher chance that patients will be less likely to get treatment and share what their medical concerns are. individuals have asked for better consent requirements by asking if physicians can warn them prior to the sharing of any personal information. patients want to be able to share medical information with their physicians, yet they worry about potential breaches that can release financial information and other confidential information and with that fear, they are wary of who may have access. in order to ensure better protection, the government has created frameworks for keeping information confidential - some of which include being transparent about procedures, disclosure and protection of information, and monitoring of these new rules to ensure that people's information is not affected by breaches. although there are many frameworks to ensure the protection of basic medical data, many organizations do not have these provisions in check. hipaa gives a false hope to patients and physicians as they are unable to protect their own information. patients have little rights regarding their medical privacy rights and physicians cannot guarantee those. hurricane katrina hipaa does not protect the information of individuals as the government is able to publish certain information when they find it necessary. the government is exempted from privacy rules regarding national security. hipaa additionally allows the authorization of protected health information (phi) in order to aid in threats to public health and safety as long as it follows the good faith requirement - the idea that disclosing of information is necessary to the benefit of the public. the model state emergency powers act (msehpa) gives the government the power to “suspend regulations, seize property, quarantine individuals and enforce vaccinations” and requires that healthcare providers give information regarding potential health emergencies". in regards to hurricane katrina, many people in louisiana relied on medicaid and their phi was subsequently affected. people's medical privacy rights were soon waived in order for patient's to get the treatment they needed. yet, many patients were unaware that their rights had been waived. in order to prevent the sharing of personal information in future natural disasters, a website was created in order to protect people's medical data. ultimately, katrina showed that the government was unprepared to face a national health scare. medical data outside of hipaa many patients mistakenly believe that hipaa protects all health information. hipaa does not usually cover fitness trackers, social media sites and other health data created by the patient. health information can be disclosed by patients in emails, blogs, chat groups, or social media sites including those dedicated to specific illnesses, "liking" web pages about diseases, completing online health and symptom checkers, and donating to health causes. in addition, credit card payments for physician visit co-pays, purchase of over the counter (otc) medications, home testing products, tobacco products, and visits to alternative practitioners are also not covered by hipaa. a 2015 study reported over 165,000 health apps available to consumers. disease treatment and management account for nearly a quarter of consumer apps. two-thirds of the apps target fitness and wellness, and ten percent of these apps can collect data from a device or sensor. since the food and drug administration (fda) only regulates medical devices and most of these applications are not medical devices, they do not require fda approval. the data from most apps are outside hipaa regulations because they do not share data with healthcare providers. "patients may mistakenly assume that mobile apps are under the scope of hipaa since the same data, such as heart rate, may be collected by an application that is accessible to their physician and covered by hipaa, or on a mobile app that is not accessible to the physician and not covered by hipaa. changes in 2000, there was a new surge to add new regulations to hipaa. it included the following goals: to protect individual medical information by providing secure access and control of their own information, improving healthcare quality by creating a more trust between consumers and their healthcare providers and third party organizations, and improve the efficiency of the medical system through new rules and regulations put forth by the local governments, individuals, and organizations. the implementation of these new goals was complicated by the change in administrations (clinton to bush), so it was difficult for the changes to be successfully implemented. hipaa, in theory, should apply to all insurance companies, services, and organizations, yet there are exceptions to who actually qualifies under these categories. yet, within each category, there are specific restrictions that are different in every category. there are no universal laws that can be easily applied that are easy for organizations can follow. thus, many states have neglected to implement these new policies. additionally, there are new patient rights that call for better protection and disclosure of health information. however, like the new rules regarding insurance companies, the enforcement of the legislation is limited and not effective as they are too broad and complex. therefore, it is difficult for many organizations to ensure the privacy of these people. enforcing these new requirements also causes companies to spend many resources that they are not willing to use and enforce, which ultimately leads to further problems regarding the invasion of an individual's medical privacy. oregon-specific laws the oregon genetic privacy act (gpa) states that “an individual’s genetic information is the property of the individual”. the idea of an individual's dna being compared to property occurred when research caused an individual's privacy to be threatened. many individuals believed that their genetic information was “more sensitive, personal, and potentially damaging than other types of medical information.” thus, people started calling for more protections. people started to question how their dna would be able to stay anonymous within research studies and argued that the identity of an individual could be exposed if the research was later shared. as a result, there was a call for individuals to treat their dna as property and protect it through property rights. therefore, individuals can control the disclosure of their information without extra questioning and research. many people believed that comparing one's dna to property was inappropriate, yet individuals argued that property and privacy are interconnected because they both want to protect the right to control one's body. many research and pharmaceutical companies showed opposition because they were worried about conflicts that might arise regarding privacy issues within their work. individuals, on the other hand, continued to support the act because they wanted protection over their own dna. as a result, lawmakers created a compromise that included a property clause, that would give individuals protection rights, but also included provisions that would allow research to be done without much consent, limiting the benefits of the provisions. afterwards, a committee was created to study the effects of the act and how it affected the way it was analyzed and stored. they found that the act benefited many individuals who did