46 ms·
It is PHI but its not subject to HIPAA because it is collected by users, not by a hospital (for example). US law governing PHI applies to data collected in the
by tantalor 8y ago
It is PHI but its not subject to HIPAA because it is collected by users, not by a hospital (for example).
US law governing PHI applies to data collected in the course of providing and paying for health care. Privacy and security regulations govern how healthcare professionals, hospitals, health insurers, and other Covered Entities use and protect the data they collect. It is important to understand that the source of the data is as relevant as the data itself when determining if information is PHI under U.S. law.
https://en.wikipedia.org/wiki/Protected_health_information https://en.wikipedia.org/wiki/Protected_health_information
This is the same reason why HIPAA does not apply to personal fitness trackers.
When consumers are collecting health data for their own use, HIPAA doesn’t come into play.
https://healthitsecurity.com/news/how-does-hipaa-apply-to-wearable-health-technology https://healthitsecurity.com/news/how-does-hipaa-apply-to-we...
- e87vrncfo3847 8y agoPeriod tracking, especially as it relates to fertility, mood, etc. - sounds like health care to me. Instead of an app company using an app, suppose it were a doctor and a notepad? Would that really be so far outside the doctor's wheelhouse as to no longer be "health care." They're collecting the data in the course of providing a health care service. Which also raises the question of medical licenses.
- nerdponx 8y agoIt's because the HIPAA law specifically defines the kinds of entities that are subject to the law, and tracking of user-input health data falls outside that definition.
- nerdponx 8y agoThis seems like a loophole in the design of the law. I don't see why a health-tracking app (or more generally, any service that I entrust with my data) shouldn't be a Covered Entity.
- tantalor 8y agoBy that reasoning, if you use Excel for health tracking then Microsoft would be subject to HIPAA.
- nerdponx 8y agoIf Microsoft is collecting and storing the contents of the Excel workbook, then why not?
- dragonwriter 8y agoIt's not a loophole, it's central to the role of the privacy provision in the law. It's important to remember with HIPAA that it wasn't a privacy law, the privacy and security provisions were included to mitigate concerns with the administrative simplification mandates and the automation incentives, and so they cover the exact same entities targeted by those provisions, and those entities are the ones (other than the patient) involved as principals or intermediaries in the patient/provider/insurer care and payment relationship.