4 ms·

These organization often sell genetic screening services, and I don't see how that is not providing medical services.

vageli 7y ago
> These organization often sell genetic screening services, and I don't see how that is not providing medical services. HIPPA only matters if the organization deals in medical insurance. Most people are surprised to learn this fact.
- EpicEng 7y ago
  Aside from that claim being trivially proven false[1], I worked in biotech for more than a decade and this is just wrong. [1]: https://www.healthit.gov/faq/who-must-follow-hipaa https://www.healthit.gov/faq/who-must-follow-hipaa
  - vageli 7y ago
    I actually am on the compliance team of a HIPPA covered entity, and your link does not disprove my point. > Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.[0] My gym nor personal trainer are covered by HIPPA as just a simple example of health-adjacent businesses for which HIPPA provides no recourse. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage.[1] [0]: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials... [1]: https://privacyruleandresearch.nih.gov/pr_06.asp https://privacyruleandresearch.nih.gov/pr_06.asp
    - EpicEng 7y ago
      What is your definition of "deals in medical insurance" exactly?
      - vageli 7y ago
        Entities that bill insurance. Here's some pretty plain language about it: https://personcenteredtech.com/2013/05/16/am-i-a-hipaa-covered-entity-how-much-does-it-matter-if-i-am-or-not/ https://personcenteredtech.com/2013/05/16/am-i-a-hipaa-cover... Like I said, most people are very surprised to learn this fact.
        EpicEng 7y ago
        >Entities that bill insurance But that's not true. Third parties, companies which do not in any way "bill insurance" or may not even provide healthcare services directly may be considered a covered entity. >Entities that provide data transmission of PHI on behalf of a covered entity (or its business associate) and that require access on a routine basis to that PHI (such as regional Health Information Organizations (HIOs)) are considered to be business associates under HIPAA
        vageli 7y ago
        The original point was around genetic testing services. [0] As an example, take 23andme. I know that they take pains to use language that would disabuse a reader of the notion that they were providing medical advice. [1] It seems that 23andme did not accept insurance of any time until after May 2019. [2] I don't know if they are seeking to become HIPAA-compliant now that they ostensibly interact with insurance looking for HIPAA anywhere on their page or various policies turns up nil. Contrast that with someone like Smile Direct Club (page title is "Privacy Policy - HIPAA". [3] Regarding the BAA exception, if you ever signed a BAA it becomes clear that your interactions with the other party to the BAA are HIPAA covered, even if your normal course of business is not. If a covered entity sends you PHI and they didn't have a BAA in place prior, that would constitute a breach. [0]: https://news.ycombinator.com/item?id=21465420 https://news.ycombinator.com/item?id=21465420 [1]: https://customercare.23andme.com/hc/en-us/articles/115013843028-What-health-related-information-can-I-learn-from-23andMe- https://customercare.23andme.com/hc/en-us/articles/115013843... [2]: https://customercare.23andme.com/hc/en-us/articles/360026466094 https://customercare.23andme.com/hc/en-us/articles/360026466... [3]: https://smiledirectclub.com/privacy/ https://smiledirectclub.com/privacy/

> These organization often sell genetic screening services, and I don't see how that is not providing medical services. HIPPA only matters if the organization deals in medical insurance. Most people are surprised to learn this fact.

EpicEng 7y ago
Aside from that claim being trivially proven false[1], I worked in biotech for more than a decade and this is just wrong. [1]: https://www.healthit.gov/faq/who-must-follow-hipaa https://www.healthit.gov/faq/who-must-follow-hipaa
- vageli 7y ago
  I actually am on the compliance team of a HIPPA covered entity, and your link does not disprove my point. > Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.[0] My gym nor personal trainer are covered by HIPPA as just a simple example of health-adjacent businesses for which HIPPA provides no recourse. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage.[1] [0]: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials... [1]: https://privacyruleandresearch.nih.gov/pr_06.asp https://privacyruleandresearch.nih.gov/pr_06.asp
  - EpicEng 7y ago
    What is your definition of "deals in medical insurance" exactly?
    - vageli 7y ago
      Entities that bill insurance. Here's some pretty plain language about it: https://personcenteredtech.com/2013/05/16/am-i-a-hipaa-covered-entity-how-much-does-it-matter-if-i-am-or-not/ https://personcenteredtech.com/2013/05/16/am-i-a-hipaa-cover... Like I said, most people are very surprised to learn this fact.
      - EpicEng 7y ago
        >Entities that bill insurance But that's not true. Third parties, companies which do not in any way "bill insurance" or may not even provide healthcare services directly may be considered a covered entity. >Entities that provide data transmission of PHI on behalf of a covered entity (or its business associate) and that require access on a routine basis to that PHI (such as regional Health Information Organizations (HIOs)) are considered to be business associates under HIPAA
        vageli 7y ago
        The original point was around genetic testing services. [0] As an example, take 23andme. I know that they take pains to use language that would disabuse a reader of the notion that they were providing medical advice. [1] It seems that 23andme did not accept insurance of any time until after May 2019. [2] I don't know if they are seeking to become HIPAA-compliant now that they ostensibly interact with insurance looking for HIPAA anywhere on their page or various policies turns up nil. Contrast that with someone like Smile Direct Club (page title is "Privacy Policy - HIPAA". [3] Regarding the BAA exception, if you ever signed a BAA it becomes clear that your interactions with the other party to the BAA are HIPAA covered, even if your normal course of business is not. If a covered entity sends you PHI and they didn't have a BAA in place prior, that would constitute a breach. [0]: https://news.ycombinator.com/item?id=21465420 https://news.ycombinator.com/item?id=21465420 [1]: https://customercare.23andme.com/hc/en-us/articles/115013843028-What-health-related-information-can-I-learn-from-23andMe- https://customercare.23andme.com/hc/en-us/articles/115013843... [2]: https://customercare.23andme.com/hc/en-us/articles/360026466094 https://customercare.23andme.com/hc/en-us/articles/360026466... [3]: https://smiledirectclub.com/privacy/ https://smiledirectclub.com/privacy/