Technological innovations are an inherent feature of the urologic operating room. Over the last 20 years, cases that were once done open have become routinely robotic. Minimally invasive techniques and miniaturization of instruments have revolutionized kidney stone disease,¹ and methods like cryotherapy and high-intensity focused ultrasound have moved into the oncologic space.² Among the many advances, we are seeing increasing popularity of video and audio recording in the operating room.³ Some institutions have started to adopt comprehensive monitoring in the form of black box technology that integrates performance metrics.⁴

In the background of our clinical practices, laws and policies shape our experience with and access to these technologies. For example, the US Food and Drug Administration approves device design and safety, the Federal Trade Commission regulates advertising, and the Department of Health and Human Services sets protections for patient access and privacy. In the case of surgical recording, many unresolved issues lie in privacy law. We are collecting swaths of surgical data which have the potential to be used for teaching, research, and quality improvement. Thoughtful and responsible use of this technology requires special attention to patient protections and data security.

The goal is to strike a balance that creates appropriate caution without stifling progress. As novel questions arise, regulations will inevitably follow. Our voices as surgeons will play an important role to mold those protections for optimal benefit to patients’ rights and privacy as well as research and innovation. Recognition of changing landscapes in privacy law can allow us to take an active role and share experiences from both the provider and patient perspectives.

The US Legal Landscape

In the US, the Department of Health and Human Services regulates privacy through the Health Insurance Portability and Accountability Act (HIPAA).⁵ This statutory law was passed in 1996, intending to specifically address and promote safe use of electronic health information.⁶ It has limited application to health care organizations as “covered entities” and collaborating partners as “business associates.”⁷

Within HIPAA, the Privacy Rule limits use of personal information and sets time periods for the data to be maintained.⁶ It grants patients the right to request accounting of disclosures, in other words, information regarding with whom their information is shared. The Security Rule requires implementation of safeguards against breaches, both physical and electronic.⁸ It also grants a right to patients to have access to their medical information in a “designated record set.”⁹ In 2009, HIPAA was modified by the Health Information Technology for Economic and Clinical Health Act which allows the record sets to be in digital form and enhances penalties, holding business associates directly accountable.¹⁰ When health care information is released outside of internal use, HIPAA requires a formal written authorization from the patient. HIPAA authorizations have express requirements such as a description of what is being disclosed and an expiration date, allowing patients to have greater awareness and control over their information.⁶

Federal statutory law is only one medium of protections. HIPAA works in tandem with state privacy protections. Where state laws provide “more stringent” protections to patients, such as private causes of action or additional consent requirements, the state laws take control. Beyond changes written into legislation, we often see effects of interpretation by executive branch agencies and courts, which whittle the law into nuanced applications. The Joint Commission, hospital policies, and professional societies can also elaborate ethical considerations above the legal requirements.

The Continued Introduction of New Technologies Will Challenge the Reach of Privacy Law

Despite this web of protections, there are loopholes. HIPAA does not consider anonymized data to fall into the medical record or require patient consent,¹¹ including unidentifiable operative videos such as laparoscopic or robotic footage. HIPAA also does not apply to information that is collected purely for quality improvement rather than individual patient care.¹² This means that large repositories of video can be maintained if all 18 HIPAA identifiers have been removed. In practice, we frequently see anonymized operative videos on social media and there have been efforts to share surgical videos as part of training. Interestingly, HIPAA de-identification rules may not sufficiently address risk of re-identification specifically in the setting of big databases and the advent of artificial intelligence.

Because HIPAA does not cover these uses, they do not fall into the designated record set that patients can request. In 2015 and 2017, Wisconsin introduced a bill that would provide a more stringent state standard, allowing patients to both request that a surgery be recorded and then requiring that it be stored in the medical record.¹³ However, to date no other states have passed a similar law.

Another area of rapid change lies with entities that have historically fallen outside of HIPAA’s reach. For example, device companies were previously exempt for interactions with patients that occur outside of the business associate relationship. However, 15 states have now passed consumer privacy laws that expand protections outside of the health care space.¹⁴

The Surgeon Perspective Is Essential to Development of the Law

Surgical recording is just one example of a technological advancement that will spur expanded regulation. To yield an optimal result, legislators will need to consider all stakeholders and understand the incentives that are created. Researchers have begun to raise important questions.³ If surgical recording is not mandatory, who is more likely to have their surgery recorded? Will lower resourced hospital systems have the technology to encrypt and store data? If patients are granted rights to see their surgeries, will we face questions of privacy for surgeons and operating room staff? Surgeons bring a unique perspective that can inform policy changes. By engaging in the development of new policies at all levels—federal, state, and professional societies—we can work to find solutions that both protect patients and optimize the power of these new technologies.