6 ms·

IANAL It’s actually way simpler than a lot of people here are making it out to be. If you are storing OR transmitting PHI you are required to be HIPAA complia

IANAL It’s actually way simpler than a lot of people here are making it out to be. If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.

ncallaway 6y ago
> It’s actually way simpler than a lot of people here are making it out to be. > If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it. IANAL I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates. Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition. Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov.... > The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA. If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so. I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.
- ryanSrich 6y ago
  I think we agree, we just define PHI differently. > “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities” They don’t use PHI here for a reason. When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI. Therefore, I believe my statement still stands.
  - Dylan16807 6y ago
    That seems like a terrible definition to me. At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about". Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
    - kindall 6y ago
      PHI means protected health information. Protected means protected by HIPAA. By definition, there is no PHI not protected by HIPAA. HIPAA is concerned with what health information must be protected and defining that defines PHI.
      - Dylan16807 6y ago
        The exact same information can be held by two different companies, yet only one of those companies is obligated to protect it.
    - ryanSrich 6y ago
      I disagree. You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA. Calling any health information “PHI” bakes in bad assumptions by both parties. The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
      - PeterisP 6y ago
        The way I see it, while the distinction you describe is correct, there's a reasonable desire that this distinction should not exist and if some app on your phone collects private health data then that data should get the same protections as if your doctor collected it; and if the app developer wants to store and process that data then they'd better be able to comply with HIPAA-like requirements or stop handling sensitive data. It's not like it currently is, but we can try and get there.
deleted 6y ago
[deleted]
dekhn 6y ago
No. If you are not a covered entity or business associate, that is not correct

IANAL It’s actually way simpler than a lot of people here are making it out to be. If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.

ncallaway 6y ago

> It’s actually way simpler than a lot of people here are making it out to be. > If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it. IANAL I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates. Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition. Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov.... > The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA. If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so. I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.

ryanSrich 6y ago
I think we agree, we just define PHI differently. > “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities” They don’t use PHI here for a reason. When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI. Therefore, I believe my statement still stands.
- Dylan16807 6y ago
  That seems like a terrible definition to me. At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about". Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
  - kindall 6y ago
    PHI means protected health information. Protected means protected by HIPAA. By definition, there is no PHI not protected by HIPAA. HIPAA is concerned with what health information must be protected and defining that defines PHI.
    - Dylan16807 6y ago
      The exact same information can be held by two different companies, yet only one of those companies is obligated to protect it.
  - ryanSrich 6y ago
    I disagree. You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA. Calling any health information “PHI” bakes in bad assumptions by both parties. The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
    - PeterisP 6y ago
      The way I see it, while the distinction you describe is correct, there's a reasonable desire that this distinction should not exist and if some app on your phone collects private health data then that data should get the same protections as if your doctor collected it; and if the app developer wants to store and process that data then they'd better be able to comply with HIPAA-like requirements or stop handling sensitive data. It's not like it currently is, but we can try and get there.

deleted 6y ago

[deleted]

dekhn 6y ago

No. If you are not a covered entity or business associate, that is not correct