5 ms·
When tech companies are subject to the same level of data protection as health care providers, complete with with HIPAA penalties for failure, then I might trus
by MereInterest 8y ago
When tech companies are subject to the same level of data protection as health care providers, complete with with HIPAA penalties for failure, then I might trust them with medical data.
- toomuchtodo 8y agoWould HIPAA not apply to tech companies when handling health data?
- danso 8y agoI don’t think so. HIPAA defines the “covered entities” — e.g. hospitals, health plans — that must follow its regulations. Being a company that handles health data does not automatically make you a covered entity. https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must-comply-with-hipaa-privacy-standards/index.html https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must...
- deleted 8y ago[deleted]
- tedivm 8y agoThis isn't 100% accurate. While I can't say much about the case of the apple watch, I can say that there are a ton of tech companies which are not covered entities but which do fall under HIPAA guidelines. For example, the company I work at is not a covered entity because we do have access to PHI we have certain regulations we have to follow. Further, we have to sign BAAs with any covered entity we work with defining who is responsible for what. Any company which deals with heathcare information should always assume they fall under HIPAA until they've hired lawyers who tell them otherwise.
- danso 8y agoDo the examples you have in mind work with data that originates with HIPAA covered entities? That, and/or doing work on behalf of a CE would likely be a situation in which you’d have to comply: https://www.techhealthperspectives.com/2012/09/25/when-does-a-health-technology-company-have-to-comply-with-hipaa/ https://www.techhealthperspectives.com/2012/09/25/when-does-... In a future where smartwatch companies integrate with a health plan/hospital’s medical records system, I would expect HIPAA to cover them. But in a case where a company is generating the data (via user consent/input), it might not be the case.
- mbreese 8y agoIf you are signing BAAs, you're probably a service provider for a covered entity and are contractually obligated to follow HIPAA. Which is different than what the original question was. For example, what is Apple's exposure here? I doubt any... they keep your data private because it's good for business (and they can then advertise how privacy conscience they are and get people to buy more watches). They aren't doing it because they have to follow HIPAA regulations. A more interesting question is -- if the Apple watch was purchased as a medical device (maybe even with insurance or a prescription), does Apple's data processing need to change at all? What about if people got a watch as part of a medical study (not people that already had the watch). Would that be different?
- astura 8y agoThis is a common misconception and comes up a lot. Rule of thumb is if it's not an insurance company or medical facility (hospital, doctor's office) HIPAA doesn't apply.
- cpuguy83 8y agoThere are problems with HIPPA for sure. In fact I trust my doctor's patient portal less than most things I log into.
- tedivm 8y agoI was at a medical conference recently (within the last year) and there was an entire talk explaining to people that they couldn't send healthcare records or pictures over snapchat. HIPAA is great- enforcement of it is not.
- deleted 8y ago[deleted]