4 ms·

Query — if one makes an excel macro that consolidates PHI into a chart, that is then copy and pasted into a medical note, and no PHI is transmitted by the macro

Query — if one makes an excel macro that consolidates PHI into a chart, that is then copy and pasted into a medical note, and no PHI is transmitted by the macro, but can instead be saved as a Marco-enabled xlsx file and emailed to another location... does that make one an CE/BA or not?

ryanSrich 6y ago
IANAL It’s actually way simpler than a lot of people here are making it out to be. If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
- ncallaway 6y ago
  > It’s actually way simpler than a lot of people here are making it out to be. > If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it. IANAL I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates. Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition. Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov.... > The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA. If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so. I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.
  - ryanSrich 6y ago
    I think we agree, we just define PHI differently. > “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities” They don’t use PHI here for a reason. When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI. Therefore, I believe my statement still stands.
    - Dylan16807 6y ago
      That seems like a terrible definition to me. At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about". Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
      - kindall 6y ago
        PHI means protected health information. Protected means protected by HIPAA. By definition, there is no PHI not protected by HIPAA. HIPAA is concerned with what health information must be protected and defining that defines PHI.
        Dylan16807 6y ago
        The exact same information can be held by two different companies, yet only one of those companies is obligated to protect it.
      - ryanSrich 6y ago
        I disagree. You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA. Calling any health information “PHI” bakes in bad assumptions by both parties. The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
- deleted 6y ago
  [deleted]
- dekhn 6y ago
  No. If you are not a covered entity or business associate, that is not correct
Spooky23 6y ago
If HIPAA compliance is difficult enough to come up with something like this, you have bigger problems. There are very challenging compliance frameworks. HIPAA isn’t one of them.
- SkyPuncher 6y ago
  Hipaa is very vague, which can make it extremely challenging.
- anonymouse008 6y ago
  > If HIPAA compliance is difficult enough to come up with something like this, you have bigger problems. I’m a bit confused. I was just giving a hypothetical product (I’ve seen similar on the market), that I can guess with high probability has not implemented protocols that I would consider proper for HIPAA. So, maybe my SAT comprehension is abysmally low... I’m not sure what you’re saying there.

ryanSrich 6y ago

IANAL It’s actually way simpler than a lot of people here are making it out to be. If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.

ncallaway 6y ago
> It’s actually way simpler than a lot of people here are making it out to be. > If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it. IANAL I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates. Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition. Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov.... > The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA. If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so. I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.
- ryanSrich 6y ago
  I think we agree, we just define PHI differently. > “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities” They don’t use PHI here for a reason. When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI. Therefore, I believe my statement still stands.
  - Dylan16807 6y ago
    That seems like a terrible definition to me. At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about". Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
    - kindall 6y ago
      PHI means protected health information. Protected means protected by HIPAA. By definition, there is no PHI not protected by HIPAA. HIPAA is concerned with what health information must be protected and defining that defines PHI.
      - Dylan16807 6y ago
        The exact same information can be held by two different companies, yet only one of those companies is obligated to protect it.
    - ryanSrich 6y ago
      I disagree. You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA. Calling any health information “PHI” bakes in bad assumptions by both parties. The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
deleted 6y ago
[deleted]
dekhn 6y ago
No. If you are not a covered entity or business associate, that is not correct

Spooky23 6y ago

If HIPAA compliance is difficult enough to come up with something like this, you have bigger problems. There are very challenging compliance frameworks. HIPAA isn’t one of them.

SkyPuncher 6y ago
Hipaa is very vague, which can make it extremely challenging.
anonymouse008 6y ago
> If HIPAA compliance is difficult enough to come up with something like this, you have bigger problems. I’m a bit confused. I was just giving a hypothetical product (I’ve seen similar on the market), that I can guess with high probability has not implemented protocols that I would consider proper for HIPAA. So, maybe my SAT comprehension is abysmally low... I’m not sure what you’re saying there.