4 ms·

Even if this data isn't collected on behalf of a healthcare provider I don't understand why the collected information wouldn't be considered PHI and therefore s

Even if this data isn't collected on behalf of a healthcare provider I don't understand why the collected information wouldn't be considered PHI and therefore subject to HIPAA's rules.

bunderbunder 8y ago
One of HIPAA's weaknesses is that the data protection requirements only apply to certain kinds of entities - basically just health care providers. That means that data may not be covered, depending on who collects it. Worse, data that was protected can legally fall out of protection if it's shared with entities that aren't bound by HIPAA. (Which, intentionally or otherwise, is something that health care providers often request the right to do as part of those HIPAA consent forms that we all sign without reading.)
- SkyPuncher 8y ago
  > basically just health care providers. From my understanding, it only applies to companies accepting health insurance and Medicare/Medicaid. If it's private pay/out of pocket only, HIPAA doesn't apply.
tantalor 8y ago
It is PHI but its not subject to HIPAA because it is collected by users, not by a hospital (for example). US law governing PHI applies to data collected in the course of providing and paying for health care. Privacy and security regulations govern how healthcare professionals, hospitals, health insurers, and other Covered Entities use and protect the data they collect. It is important to understand that the source of the data is as relevant as the data itself when determining if information is PHI under U.S. law. https://en.wikipedia.org/wiki/Protected_health_information https://en.wikipedia.org/wiki/Protected_health_information This is the same reason why HIPAA does not apply to personal fitness trackers. When consumers are collecting health data for their own use, HIPAA doesn’t come into play. https://healthitsecurity.com/news/how-does-hipaa-apply-to-wearable-health-technology https://healthitsecurity.com/news/how-does-hipaa-apply-to-we...
- e87vrncfo3847 8y ago
  Period tracking, especially as it relates to fertility, mood, etc. - sounds like health care to me. Instead of an app company using an app, suppose it were a doctor and a notepad? Would that really be so far outside the doctor's wheelhouse as to no longer be "health care." They're collecting the data in the course of providing a health care service. Which also raises the question of medical licenses.
  - nerdponx 8y ago
    It's because the HIPAA law specifically defines the kinds of entities that are subject to the law, and tracking of user-input health data falls outside that definition.
- nerdponx 8y ago
  This seems like a loophole in the design of the law. I don't see why a health-tracking app (or more generally, any service that I entrust with my data) shouldn't be a Covered Entity.
  - tantalor 8y ago
    By that reasoning, if you use Excel for health tracking then Microsoft would be subject to HIPAA.
    - nerdponx 8y ago
      If Microsoft is collecting and storing the contents of the Excel workbook, then why not?
  - dragonwriter 8y ago
    It's not a loophole, it's central to the role of the privacy provision in the law. It's important to remember with HIPAA that it wasn't a privacy law, the privacy and security provisions were included to mitigate concerns with the administrative simplification mandates and the automation incentives, and so they cover the exact same entities targeted by those provisions, and those entities are the ones (other than the patient) involved as principals or intermediaries in the patient/provider/insurer care and payment relationship.
howard941 8y ago
It's not PHI because PHI is a term expressly defined to be "individually identifiable health information" held by a "Covered Entit(y)". See the gory details at https://www.law.cornell.edu/cfr/text/45/160.103 https://www.law.cornell.edu/cfr/text/45/160.103
jbob2000 8y ago
It needs to be personally identifiable. If the app isn’t tracking who’s data it’s collecting, then it’s not PHI.
- tengbretson 8y ago
  Surely they are associating this with either an email address or a device fingerprint, both of which would be considered personally identifying by HIPAA.
DoreenMichele 8y ago
Because HIPAA is a regulation for specific industries. This includes healthcare providers and insurance. It doesn't include every service that tracks anything that could be construed as health data. In practice, if you are a service working with covered industries, they will insist you be HIPAA compliant so they can't be fined. Individuals tracking their own information don't fall under HIPAA regulation.
Spooky23 8y ago
HIPPA doesn't prevent your health data from being used for marketing purposes. For example, a baby formula company can identity with reasonable certainty when you're going to deliver a baby based on insurance claim and prescription data.
dragonwriter 8y ago
> Even if this data isn't collected on behalf of a healthcare provider I don't understand why the collected information wouldn't be considered PHI and therefore subject to HIPAA's rules. Because, under HIPAA, PHI is a subset of individually identifiable health information, and individually identifiable health information is a subset of health information, and health information excludes anything that is not, “created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse” (and if it's employment records held by an employer in their role as an employer, it's excluded from PHI even if it is individually identifiable health information.)

Even if this data isn't collected on behalf of a healthcare provider I don't understand why the collected information wouldn't be considered PHI and therefore subject to HIPAA's rules.

bunderbunder 8y ago

One of HIPAA's weaknesses is that the data protection requirements only apply to certain kinds of entities - basically just health care providers. That means that data may not be covered, depending on who collects it. Worse, data that was protected can legally fall out of protection if it's shared with entities that aren't bound by HIPAA. (Which, intentionally or otherwise, is something that health care providers often request the right to do as part of those HIPAA consent forms that we all sign without reading.)

SkyPuncher 8y ago
> basically just health care providers. From my understanding, it only applies to companies accepting health insurance and Medicare/Medicaid. If it's private pay/out of pocket only, HIPAA doesn't apply.

tantalor 8y ago

It is PHI but its not subject to HIPAA because it is collected by users, not by a hospital (for example). US law governing PHI applies to data collected in the course of providing and paying for health care. Privacy and security regulations govern how healthcare professionals, hospitals, health insurers, and other Covered Entities use and protect the data they collect. It is important to understand that the source of the data is as relevant as the data itself when determining if information is PHI under U.S. law. https://en.wikipedia.org/wiki/Protected_health_information https://en.wikipedia.org/wiki/Protected_health_information This is the same reason why HIPAA does not apply to personal fitness trackers. When consumers are collecting health data for their own use, HIPAA doesn’t come into play. https://healthitsecurity.com/news/how-does-hipaa-apply-to-wearable-health-technology https://healthitsecurity.com/news/how-does-hipaa-apply-to-we...

e87vrncfo3847 8y ago
Period tracking, especially as it relates to fertility, mood, etc. - sounds like health care to me. Instead of an app company using an app, suppose it were a doctor and a notepad? Would that really be so far outside the doctor's wheelhouse as to no longer be "health care." They're collecting the data in the course of providing a health care service. Which also raises the question of medical licenses.
- nerdponx 8y ago
  It's because the HIPAA law specifically defines the kinds of entities that are subject to the law, and tracking of user-input health data falls outside that definition.
nerdponx 8y ago
This seems like a loophole in the design of the law. I don't see why a health-tracking app (or more generally, any service that I entrust with my data) shouldn't be a Covered Entity.
- tantalor 8y ago
  By that reasoning, if you use Excel for health tracking then Microsoft would be subject to HIPAA.
  - nerdponx 8y ago
    If Microsoft is collecting and storing the contents of the Excel workbook, then why not?
- dragonwriter 8y ago
  It's not a loophole, it's central to the role of the privacy provision in the law. It's important to remember with HIPAA that it wasn't a privacy law, the privacy and security provisions were included to mitigate concerns with the administrative simplification mandates and the automation incentives, and so they cover the exact same entities targeted by those provisions, and those entities are the ones (other than the patient) involved as principals or intermediaries in the patient/provider/insurer care and payment relationship.

howard941 8y ago

It's not PHI because PHI is a term expressly defined to be "individually identifiable health information" held by a "Covered Entit(y)". See the gory details at https://www.law.cornell.edu/cfr/text/45/160.103 https://www.law.cornell.edu/cfr/text/45/160.103

jbob2000 8y ago

It needs to be personally identifiable. If the app isn’t tracking who’s data it’s collecting, then it’s not PHI.

tengbretson 8y ago
Surely they are associating this with either an email address or a device fingerprint, both of which would be considered personally identifying by HIPAA.

DoreenMichele 8y ago

Because HIPAA is a regulation for specific industries. This includes healthcare providers and insurance. It doesn't include every service that tracks anything that could be construed as health data. In practice, if you are a service working with covered industries, they will insist you be HIPAA compliant so they can't be fined. Individuals tracking their own information don't fall under HIPAA regulation.

Spooky23 8y ago

HIPPA doesn't prevent your health data from being used for marketing purposes. For example, a baby formula company can identity with reasonable certainty when you're going to deliver a baby based on insurance claim and prescription data.

dragonwriter 8y ago

> Even if this data isn't collected on behalf of a healthcare provider I don't understand why the collected information wouldn't be considered PHI and therefore subject to HIPAA's rules. Because, under HIPAA, PHI is a subset of individually identifiable health information, and individually identifiable health information is a subset of health information, and health information excludes anything that is not, “created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse” (and if it's employment records held by an employer in their role as an employer, it's excluded from PHI even if it is individually identifiable health information.)