6 ms·

> First step: figure out if you are a covered entity or a business associate, or neither. If not, the law doesn't apply to you. If you are a "covered entity" t

> First step: figure out if you are a covered entity or a business associate, or neither. If not, the law doesn't apply to you. If you are a "covered entity" try and work out if you can stop being one. If you can avoid collecting HIPAA relevant data and still make your business model work, that's likely to be a significantly easier path to take than ensuring ongoing compliance. (Same as PCI compliance - outsource all that brain damage to Stripe or Square or whoever, and be able to look a judge in the eye and say "We never even see credit card data.")

rsj_hn 6y ago
Wise words. Information should be treated as toxic effluvia and HIPAA compliance (as well as GDPR and related laws) should be considered as superfund cleanup procedures. They are expensive, complex, and fraught with legal risk. Don't collect information, don't store it, unless absolutely necessary and you can't find an expert certified third party to handle it for you.
- sokoloff 6y ago
  We had a PCI QSA who argued that pages that linked out to payment processors were in full scope for PCI, because if compromised, they could be changed to point to a compromised payment entry site. Which logically means that pages which point to those pages are also in scope, all the way up the stack and suddenly everything is in full PCI scope. Absolutely use a PSP to minimize your wasted effort on compliance activities, but also choose a sane QSA.
  - hn_throwaway_99 6y ago
    Note this is explicitly covered in the PCI self-assessment questionnaire levels. SAQ A-EP is specifically for websites where you own the website, but link out to something like Stripe for the payment processing. Here's a good overview I found googling for "SAQ A-EP vs SAQ A": https://epayments-support.ingenico.com/en/direct/faq/comparison-of-the-saq-a-vs-saq-a-ep https://epayments-support.ingenico.com/en/direct/faq/compari...
    - sokoloff 6y ago
      It's been over a decade now, but I seem to recall the debate was not about "what needs to happen if this page is a payment page?" but rather was around "what makes a page in-scope for that requirement to apply?" and the QSA initially held/expressed an entirely illogical position on the matter.
      - URSpider94 6y ago
        That’s what I call the “divide by zero quality system”. If you don’t ship, then there’s no risk of leaking customer data. Likewise, if you just assume that every screen in your app is in-scope for PCI, then the consultant has a very easy job.
anonymouse008 6y ago
Query — if one makes an excel macro that consolidates PHI into a chart, that is then copy and pasted into a medical note, and no PHI is transmitted by the macro, but can instead be saved as a Marco-enabled xlsx file and emailed to another location... does that make one an CE/BA or not?
- ryanSrich 6y ago
  IANAL It’s actually way simpler than a lot of people here are making it out to be. If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
  - ncallaway 6y ago
    > It’s actually way simpler than a lot of people here are making it out to be. > If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it. IANAL I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates. Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition. Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov.... > The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA. If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so. I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.
donatj 6y ago
PCI compliance is a little different as it’s an industry standard and not a legal standard. Far less fear of prison time if you mess it up. That said it’s still way better to outsource all that worry.

rsj_hn 6y ago

Wise words. Information should be treated as toxic effluvia and HIPAA compliance (as well as GDPR and related laws) should be considered as superfund cleanup procedures. They are expensive, complex, and fraught with legal risk. Don't collect information, don't store it, unless absolutely necessary and you can't find an expert certified third party to handle it for you.

sokoloff 6y ago
We had a PCI QSA who argued that pages that linked out to payment processors were in full scope for PCI, because if compromised, they could be changed to point to a compromised payment entry site. Which logically means that pages which point to those pages are also in scope, all the way up the stack and suddenly everything is in full PCI scope. Absolutely use a PSP to minimize your wasted effort on compliance activities, but also choose a sane QSA.
- hn_throwaway_99 6y ago
  Note this is explicitly covered in the PCI self-assessment questionnaire levels. SAQ A-EP is specifically for websites where you own the website, but link out to something like Stripe for the payment processing. Here's a good overview I found googling for "SAQ A-EP vs SAQ A": https://epayments-support.ingenico.com/en/direct/faq/comparison-of-the-saq-a-vs-saq-a-ep https://epayments-support.ingenico.com/en/direct/faq/compari...
  - sokoloff 6y ago
    It's been over a decade now, but I seem to recall the debate was not about "what needs to happen if this page is a payment page?" but rather was around "what makes a page in-scope for that requirement to apply?" and the QSA initially held/expressed an entirely illogical position on the matter.
    - URSpider94 6y ago
      That’s what I call the “divide by zero quality system”. If you don’t ship, then there’s no risk of leaking customer data. Likewise, if you just assume that every screen in your app is in-scope for PCI, then the consultant has a very easy job.

anonymouse008 6y ago

Query — if one makes an excel macro that consolidates PHI into a chart, that is then copy and pasted into a medical note, and no PHI is transmitted by the macro, but can instead be saved as a Marco-enabled xlsx file and emailed to another location... does that make one an CE/BA or not?

ryanSrich 6y ago
IANAL It’s actually way simpler than a lot of people here are making it out to be. If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
- ncallaway 6y ago
  > It’s actually way simpler than a lot of people here are making it out to be. > If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it. IANAL I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates. Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition. Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov.... > The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA. If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so. I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.

donatj 6y ago

PCI compliance is a little different as it’s an industry standard and not a legal standard. Far less fear of prison time if you mess it up. That said it’s still way better to outsource all that worry.