HIPAA is often described as a privacy rule. It is not. In fact, HIPAA is a disclosure regulation. Effective in April 2003, the federal government gave six hundred thousand “covered entities” regulatory permission “to use or disclose protected health information for treatment, payment, and health care operations” without patient consent, and with no audit trails for most disclosures. The effect is to dismantle the longstanding moral and legal tradition of patient confidentiality. By permitting broad and easy dissemination of patients’ medical information, HIPAA has undermined both medical ethics and the effectiveness of medical care.