4 ms·

I think we agree, we just define PHI differently. > “ Many organizations that use, collect, access, and disclose individually identifiable health information w

I think we agree, we just define PHI differently. > “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities” They don’t use PHI here for a reason. When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI. Therefore, I believe my statement still stands.

Dylan16807 6y ago
That seems like a terrible definition to me. At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about". Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
- kindall 6y ago
  PHI means protected health information. Protected means protected by HIPAA. By definition, there is no PHI not protected by HIPAA. HIPAA is concerned with what health information must be protected and defining that defines PHI.
  - Dylan16807 6y ago
    The exact same information can be held by two different companies, yet only one of those companies is obligated to protect it.
- ryanSrich 6y ago
  I disagree. You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA. Calling any health information “PHI” bakes in bad assumptions by both parties. The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
  - PeterisP 6y ago
    The way I see it, while the distinction you describe is correct, there's a reasonable desire that this distinction should not exist and if some app on your phone collects private health data then that data should get the same protections as if your doctor collected it; and if the app developer wants to store and process that data then they'd better be able to comply with HIPAA-like requirements or stop handling sensitive data. It's not like it currently is, but we can try and get there.
dekhn 6y ago
this is not the legal definition of PHI in HIPAA
ncallaway 6y ago
I think it's still incorrect to disregard the entity. HIPAA only creates privacy obligations to Covered Entities and Business Associates. It doesn't apply obligations to all people who might receive Protected Health Information. If a hospital makes an error, and emails the medical charts for a public figure to a journalist, the journalist has no obligations under HIPAA. They would be free to publish the information, to store it without privacy safeguards, etc. The data remains PHI, but the journalist is not required to follow the HIPAA privacy rule. Though, I again think it would generally be better if the voluntarily did so. By my (again, also a non-lawyer understanding) the privacy rule is a venn diagram that only applies if: - You are a Covered Entity or Business Associate, AND - The data being handled is Protected Health Information

Dylan16807 6y ago

That seems like a terrible definition to me. At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about". Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.

kindall 6y ago
PHI means protected health information. Protected means protected by HIPAA. By definition, there is no PHI not protected by HIPAA. HIPAA is concerned with what health information must be protected and defining that defines PHI.
- Dylan16807 6y ago
  The exact same information can be held by two different companies, yet only one of those companies is obligated to protect it.
ryanSrich 6y ago
I disagree. You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA. Calling any health information “PHI” bakes in bad assumptions by both parties. The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
- PeterisP 6y ago
  The way I see it, while the distinction you describe is correct, there's a reasonable desire that this distinction should not exist and if some app on your phone collects private health data then that data should get the same protections as if your doctor collected it; and if the app developer wants to store and process that data then they'd better be able to comply with HIPAA-like requirements or stop handling sensitive data. It's not like it currently is, but we can try and get there.

dekhn 6y ago

this is not the legal definition of PHI in HIPAA

ncallaway 6y ago

I think it's still incorrect to disregard the entity. HIPAA only creates privacy obligations to Covered Entities and Business Associates. It doesn't apply obligations to all people who might receive Protected Health Information. If a hospital makes an error, and emails the medical charts for a public figure to a journalist, the journalist has no obligations under HIPAA. They would be free to publish the information, to store it without privacy safeguards, etc. The data remains PHI, but the journalist is not required to follow the HIPAA privacy rule. Though, I again think it would generally be better if the voluntarily did so. By my (again, also a non-lawyer understanding) the privacy rule is a venn diagram that only applies if: - You are a Covered Entity or Business Associate, AND - The data being handled is Protected Health Information