4 ms·
Unlikely to be a HIPAA violation, pretty standard to get a BAA in place between entities sharing PHI type data. Its spelled out on those HIPAA forms you sign at
by oakmad 7y ago
Unlikely to be a HIPAA violation, pretty standard to get a BAA in place between entities sharing PHI type data. Its spelled out on those HIPAA forms you sign at the providers before they'll see you.
"The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule."
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
- rabidonrails 7y agoYour quote misses the most important part: >>"Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions – not for the business associate’s independent use or purposes, except as needed for the proper management and administration of the business associate." BAA's keep the chain of HIPAA in place but just because a BAA is in place does not allow for violation of privacy.
- oakmad 7y agoAgreed. The key point I was attempting to make is that a BAA allows orgs to share data legally. AFAIK Google hasn't violated any privacy with this project and indeed they would be in violation if they did.