Are medical records private?

Somewhat rhetorical: Is the NSA or other government agency also slurping up our medical records?

I'm now out of the loop. This is a question I'm hoping someone is asking.

Back when I implemented health information exchanges, we often had live data feeds to the CDC. Which is a great idea. True, patient data is de-identified. But that's meaningless if you have enough data to mine.

Data feeds between participants were typically SCP or VPN. But I have no idea how much protection that offers. Having worked with hospitals, I suspect the ends points are the weak links.

Sitting here listening to a presentation on the Affordable Care Act and all the reforms, including the new patient protections, I'm reminded to wonder what level of surveillance is being done.