4 ms·

>Entities that bill insurance But that's not true. Third parties, companies which do not in any way "bill insurance" or may not even provide healthcare service

>Entities that bill insurance But that's not true. Third parties, companies which do not in any way "bill insurance" or may not even provide healthcare services directly may be considered a covered entity. >Entities that provide data transmission of PHI on behalf of a covered entity (or its business associate) and that require access on a routine basis to that PHI (such as regional Health Information Organizations (HIOs)) are considered to be business associates under HIPAA

vageli 7y ago
The original point was around genetic testing services. [0] As an example, take 23andme. I know that they take pains to use language that would disabuse a reader of the notion that they were providing medical advice. [1] It seems that 23andme did not accept insurance of any time until after May 2019. [2] I don't know if they are seeking to become HIPAA-compliant now that they ostensibly interact with insurance looking for HIPAA anywhere on their page or various policies turns up nil. Contrast that with someone like Smile Direct Club (page title is "Privacy Policy - HIPAA". [3] Regarding the BAA exception, if you ever signed a BAA it becomes clear that your interactions with the other party to the BAA are HIPAA covered, even if your normal course of business is not. If a covered entity sends you PHI and they didn't have a BAA in place prior, that would constitute a breach. [0]: https://news.ycombinator.com/item?id=21465420 https://news.ycombinator.com/item?id=21465420 [1]: https://customercare.23andme.com/hc/en-us/articles/115013843028-What-health-related-information-can-I-learn-from-23andMe- https://customercare.23andme.com/hc/en-us/articles/115013843... [2]: https://customercare.23andme.com/hc/en-us/articles/360026466094 https://customercare.23andme.com/hc/en-us/articles/360026466... [3]: https://smiledirectclub.com/privacy/ https://smiledirectclub.com/privacy/

vageli 7y ago

The original point was around genetic testing services. [0] As an example, take 23andme. I know that they take pains to use language that would disabuse a reader of the notion that they were providing medical advice. [1] It seems that 23andme did not accept insurance of any time until after May 2019. [2] I don't know if they are seeking to become HIPAA-compliant now that they ostensibly interact with insurance looking for HIPAA anywhere on their page or various policies turns up nil. Contrast that with someone like Smile Direct Club (page title is "Privacy Policy - HIPAA". [3] Regarding the BAA exception, if you ever signed a BAA it becomes clear that your interactions with the other party to the BAA are HIPAA covered, even if your normal course of business is not. If a covered entity sends you PHI and they didn't have a BAA in place prior, that would constitute a breach. [0]: https://news.ycombinator.com/item?id=21465420 https://news.ycombinator.com/item?id=21465420 [1]: https://customercare.23andme.com/hc/en-us/articles/115013843028-What-health-related-information-can-I-learn-from-23andMe- https://customercare.23andme.com/hc/en-us/articles/115013843... [2]: https://customercare.23andme.com/hc/en-us/articles/360026466094 https://customercare.23andme.com/hc/en-us/articles/360026466... [3]: https://smiledirectclub.com/privacy/ https://smiledirectclub.com/privacy/